Salvador KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Salvador.
- Dernière revue
- Dernière revue:
- Version
- Version 1.0
Réponse directe
Que couvre la checklist de conformité pour Salvador ?
La checklist pour Salvador traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 37 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- National FIU
- Unidad de Investigación Financiera (UIF), an autonomous specialist office attached to the Fiscalía General de la República
- Primary AML rule
- Decree 426 special AML/CFT/CPF law, effective 24 October 2025
- Suspicion reporting
- Analyze within up to 15 business days; report to UIF within 24 hours after a suspicious determination
- Regulated reports
- Report covered linked transactions within 5 business days; transitional thresholds require current-instrument confirmation
- Beneficial owner
- Natural person with at least 25% ownership or voting rights, or control by other means
- Retention
- At least 15 years: transaction completion or relationship/account termination, depending on the record
- Privacy authority
- Agencia de Ciberseguridad del Estado (ACE)
- FATF status
- GAFILAT member; absent from FATF June 2026 public lists as reviewed 6 August 2026
Détail d’implémentation
Exigences et actions de conformité pour Salvador
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities, and licensingMap the business to Decree 426's closed subject categories and the applicable sector supervisor before onboarding.3 éléments+
Determine whether the entity is a subject obliged under the new special law.
- Action d’implémentation
- Map each product and legal entity to article 7, including financial institutions, specified lenders, DNFBPs, money/value transport, digital-asset or bitcoin providers and political parties; document any out-of-scope conclusion.
- Preuves à conserver
- Perimeter memorandum, product map, legal-entity chart and counsel confirmation.
- Source primaire
- Decree 426 arts. 1, 7-9
Identify the competent supervisor and complete required registrations or authorisations.
- Action d’implémentation
- Confirm SSF, Superintendencia de Obligaciones Mercantiles, CNAD or other article 11-12 supervision; separately test financial, payments, bitcoin and digital-asset licensing before launch.
- Preuves à conserver
- Supervisor mapping, licence analysis, registrations, approvals and correspondence.
- Source primaire
- Decree 426 arts. 11-13; Digital Assets Issuance Law arts. 18-20
Treat the regulation and UIF instruction as a controlled transition.
- Action d’implémentation
- At launch and each rules refresh, verify whether the preserved 2000 regulation and current UIF instruction have been replaced under the 2025 law; apply only provisions that do not conflict with Decree 426.
- Preuves à conserver
- Dated legal-update check, downloaded instruments and conflict analysis.
- Source primaire
- Decree 426 arts. 55-62; UIF current-law FAQ
02Governance and risk assessmentControls must be proportionate to identified AML/CFT/CPF risk and avoid unsupported blanket exclusion.3 éléments+
Operate a documented risk-based AML/CFT/CPF system.
- Action d’implémentation
- Assess customer, product, channel, transaction and geographic risks; set simplified, standard or enhanced controls and obtain governance approval.
- Preuves à conserver
- Enterprise risk assessment, methodology, risk appetite, control matrix and approval minutes.
- Source primaire
- Decree 426 arts. 9, 13, 15-17
Appoint the required compliance function and deputies.
- Action d’implémentation
- For SSF-, CNAD- and article 7(2)-supervised entities establish a compliance office with principal and alternate; other supervised entities must appoint a principal and alternate unless a statutory exception applies.
- Preuves à conserver
- Board resolutions, role profiles, independence record, UIF/supervisor filings and training evidence.
- Source primaire
- Decree 426 arts. 20-22
Create the prevention committee when a compliance office is mandatory.
- Action d’implémentation
- Maintain a committee of at least three members, including one member of the highest governing body and the compliance officer, with recorded decisions.
- Preuves à conserver
- Committee charter, appointments, meeting book and action log.
- Source primaire
- Decree 426 art. 23
03Natural-person identificationIdentification and verification must be risk-based, reconstructable and completed for the relationship and relevant occasional activity.3 éléments+
Identify and verify the customer and any representative.
- Action d’implémentation
- Collect authoritative identity data, verify the document and person, validate authority for representatives, screen, risk-rate and record purpose before activation.
- Preuves à conserver
- Identity evidence, liveness or equivalent checks, authority document, screening log and onboarding decision.
- Source primaire
- Decree 426 art. 15
Apply CDD at statutory trigger points.
- Action d’implémentation
- Perform CDD when establishing a relationship, for occasional transactions above the applicable cash-report threshold, on suspicion, or when prior identity data is doubtful; obtain current sector thresholds before deployment.
- Preuves à conserver
- Trigger matrix, transaction evidence, refresh record and escalation log.
- Source primaire
- Decree 426 art. 15
Do not maintain anonymous or coded relationships.
- Action d’implémentation
- Require nominative customer records and block product activation where required identity evidence is not provided; consider a suspicious-attempt report after analysis.
- Preuves à conserver
- Account configuration, rejection record and documented reporting decision.
- Source primaire
- Decree 426 art. 15
04KYB, registries, and beneficial ownershipCompany verification must combine registry evidence with independent ownership-and-control analysis.4 éléments+
Verify legal existence, representatives, activity and powers.
- Action d’implémentation
- Obtain a current CNR Registro de Comercio certification or equivalent source, constitutive documents, tax details, business address and authority chain; independently verify material facts.
- Preuves à conserver
- Registry certification, formation documents, tax evidence, address check and authority map.
- Source primaire
- Decree 426 art. 15; Commercial Code; CNR Registro de Comercio
Identify natural persons meeting the statutory beneficial-owner test.
- Action d’implémentation
- Trace direct and indirect ownership and voting rights to every natural person at or above 25%, and identify any natural person exercising control by other means.
- Preuves à conserver
- Ownership chart, cap table, registry documents, shareholder evidence and control analysis.
- Source primaire
- Decree 426 art. 15
Apply the listed-company exception narrowly.
- Action d’implémentation
- Use the exception only where the client or owner has at least 25% in a listed commercial company subject to market disclosure requirements; document the market and disclosure basis.
- Preuves à conserver
- Listing evidence, disclosure-rule analysis and approval.
- Source primaire
- Decree 426 art. 15
Do not treat registry access as proof of a comprehensive public BO register.
- Action d’implémentation
- Use CNR company records as one input and obtain ownership/control evidence directly; confirm current beneficial-ownership filing and access arrangements with CNR and the supervisor.
- Preuves à conserver
- CNR search, certified extracts, customer declaration, corroboration and uncertainty log.
- Source primaire
- CNR Registro de Comercio services; controlled uncertainty
05PEPs, EDD, and remote onboardingHigh-risk relationships require verified source information and a documented, individualized decision.3 éléments+
Identify domestic, foreign and international-organisation PEPs.
- Action d’implémentation
- Screen customers, beneficial owners, representatives and connected parties; continue PEP treatment for five years after the last appointment and apply enhanced diligence to specified family and close associates.
- Preuves à conserver
- Screening results, position verification, relationship mapping and five-year control.
- Source primaire
- Decree 426 art. 19
Verify source of wealth and source of funds for high-risk customers.
- Action d’implémentation
- Collect and corroborate wealth and funds evidence proportionate to risk and obtain the required senior approval before activation or continuation.
- Preuves à conserver
- Source dossier, corroboration, risk rationale, approval and monitoring plan.
- Source primaire
- Decree 426 arts. 15, 19; current UIF instruction
Make remote onboarding equivalent and auditable.
- Action d’implémentation
- Use authoritative document validation, impersonation and liveness controls, device and channel signals, sanctions/PEP screening, step-up checks and manual exception review.
- Preuves à conserver
- Vendor testing, model thresholds, session record, fraud results and exception approvals.
- Source primaire
- Decree 426 arts. 15-17; risk-based implementation control
06Monitoring and suspicious reportingUnusual activity must be analyzed promptly and reports sent confidentially through UIF-authorized channels.4 éléments+
Monitor relationships and investigate unusual activity.
- Action d’implémentation
- Calibrate scenarios to the risk assessment, preserve alert inputs, investigate context and document whether sufficient grounds for suspicion exist.
- Preuves à conserver
- Scenario inventory, alert file, analyst workpaper, disposition and quality review.
- Source primaire
- Decree 426 arts. 9, 15, 24
Complete unusual-operation analysis within the statutory window.
- Action d’implémentation
- Finish analysis within 15 business days of detection; request the single permitted equal extension from UIF through the compliance officer when justified.
- Preuves à conserver
- Detection timestamp, case chronology, extension request and UIF response.
- Source primaire
- Decree 426 art. 24
Report suspicious, attempted and suspicious-activity cases to UIF.
- Action d’implémentation
- After determining suspicion, submit the authorized report promptly and no later than 24 hours, regardless of amount, using the current UIF channel and format.
- Preuves à conserver
- Decision timestamp, submitted report, receipt, supporting file and access log.
- Source primaire
- Decree 426 arts. 3-4, 24
Protect report confidentiality and prevent tipping off.
- Action d’implémentation
- Restrict report and UIF-request access; do not disclose reports or related requests to customers, users, third parties, auditors or supervisors except as lawfully directed.
- Preuves à conserver
- Restricted permissions, disclosure protocol, staff attestations and incident log.
- Source primaire
- Decree 426 arts. 24, 28
07Payments, wires, thresholds, and digital assetsThreshold reporting and regulated financial or digital-asset activity require current parameter and licence checks.4 éléments+
Report regulated transactions within five business days.
- Action d’implémentation
- Aggregate transactions in one event or over a month where they appear linked, and report covered cash, other-means, local/international electronic-transfer and digital-asset transactions to UIF within five business days.
- Preuves à conserver
- Aggregation logic, threshold table, report files, receipts and timeliness metrics.
- Source primaire
- Decree 426 art. 25
Confirm transitional thresholds before configuring production.
- Action d’implémentation
- Reconcile Decree 426, any new regulation and the preserved UIF instruction. UIF's current FAQ states instruction thresholds above USD 10,000 cash, USD 25,000 other means and USD 1,000 electronic transfers; do not generalize them without sector confirmation.
- Preuves à conserver
- Dated instrument set, supervisor confirmation, configuration approval and change log.
- Source primaire
- Decree 426 arts. 25, 61; UIF current-law FAQ
Preserve complete originator and beneficiary information for transfers.
- Action d’implémentation
- Collect, validate, transmit and retain the fields required by the applicable BCR/SSF/UIF or CNAD instrument; pause or escalate incomplete transfers under the current sector rule.
- Preuves à conserver
- Message fields, validation logs, exception queue and current-rule mapping.
- Source primaire
- Decree 426 arts. 15, 25-26; current sector instruments
Register digital-asset services with CNAD where the territorial and service tests apply.
- Action d’implémentation
- Before offering article 19 digital-asset services from El Salvador or actively marketing them into the country, complete CNAD registration and confirm UIF obligations; separately analyze bitcoin services supervised by SSF.
- Preuves à conserver
- Territorial analysis, CNAD registration, public-register check, UIF record and SSF analysis.
- Source primaire
- Digital Assets Issuance Law arts. 18-20; Decree 426 arts. 7, 12
08Targeted financial sanctionsScreening must cover binding designations and produce an immediate, traceable escalation.3 éléments+
Screen UN and applicable national designations continuously.
- Action d’implémentation
- Screen customers, beneficial owners, representatives and transactions at onboarding, list change and before value movement using UIF-published access points.
- Preuves à conserver
- List sources, update logs, screening results, match records and test evidence.
- Source primaire
- Special Law Against Acts of Terrorism art. 37; Decree 426 arts. 10, 32; UIF international-lists portal
Prevent dealing and freeze on a confirmed designation match without delay.
- Action d’implémentation
- Stop transactions immediately, preserve assets and notify through the current UIF/FGR process; do not release funds without competent authority direction.
- Preuves à conserver
- Match chronology, freeze record, report receipt, communications and release authority.
- Source primaire
- Special Law Against Acts of Terrorism art. 37; Decree 426 arts. 10, 32
Control false positives, delisting and exceptions.
- Action d’implémentation
- Use a documented escalation that protects confidentiality and obtains UIF/FGR or judicial direction for unfreezing, delisting or permitted access; confirm live procedure before launch.
- Preuves à conserver
- Escalation file, identity comparison, authority response and audit trail.
- Source primaire
- UIF sanctions guidance and exercises; controlled uncertainty
09Records and regulator accessThe 2025 law materially extends AML records to at least 15 years.3 éléments+
Retain reconstructable transaction records for at least 15 years.
- Action d’implémentation
- Preserve domestic and international transaction records for at least 15 years from completion, sufficient to reconstruct each transaction and answer authority requests immediately.
- Preuves à conserver
- Retention schedule, transaction archive, retrieval tests and deletion holds.
- Source primaire
- Decree 426 art. 26
Retain customer identification and account files for at least 15 years after exit.
- Action d’implémentation
- Start the period at relationship termination or account closure; preserve legal holds and secure electronic accessibility.
- Preuves à conserver
- Closure date, customer file archive, legal-hold record and retrieval test.
- Source primaire
- Decree 426 art. 26
Respond securely to UIF, supervisor, FGR and court requests.
- Action d’implémentation
- Authenticate requests, preserve scope and chain of custody, meet the stated deadline and keep a restricted disclosure log.
- Preuves à conserver
- Request register, authentication, production manifest and transmission receipt.
- Source primaire
- Decree 426 arts. 4, 26, 28, 52-53
10Privacy, biometrics, and transfersAML processing must also satisfy the Personal Data Protection Law and ACE policy, subject to lawful AML retention and disclosure duties.4 éléments+
Document a lawful, transparent and minimized KYC processing design.
- Action d’implémentation
- Map each data element and purpose, provide required notices, identify the lawful basis, minimize collection and reconcile deletion rights with the 15-year AML retention duty.
- Preuves à conserver
- Processing register, privacy notice, purpose/basis matrix, retention reconciliation and rights procedure.
- Source primaire
- Personal Data Protection Law arts. 5 and 24; Decree 426 art. 26
Apply enhanced safeguards to sensitive and biometric data.
- Action d’implémentation
- Complete an impact assessment, restrict access, encrypt data, test biometric vendors and document necessity, proportionality and fallback paths.
- Preuves à conserver
- Impact assessment, security design, vendor diligence, test results and access logs.
- Source primaire
- Personal Data Protection Law; ACE Policies 001-0309025-DPDP arts. 3-6
Prepare breach notification and response workflows.
- Action d’implémentation
- Detect, contain and assess incidents and maintain a workflow capable of notifying ACE, FGR and affected individuals within 72 hours where the ACE policy requires it.
- Preuves à conserver
- Incident plan, severity assessment, decision log, notifications and post-incident review.
- Source primaire
- ACE Policies 001-0309025-DPDP art. 4
Control processors and international transfers.
- Action d’implémentation
- Contract for confidentiality, security, auditability and deletion; assess equivalent protection for international transfers and preserve a current data-flow map.
- Preuves à conserver
- Processor contracts, transfer assessment, country map, encryption evidence and approval.
- Source primaire
- Personal Data Protection Law; ACE Policies 001-0309025-DPDP art. 4
11Practical evidence packsEvidence should enable independent reconstruction of onboarding, monitoring, reporting and governance decisions.3 éléments+
Maintain one indexed file per customer or legal entity.
- Action d’implémentation
- Link identity, KYB, beneficial ownership, screening, risk, approvals, monitoring, refreshes, source evidence and exit decisions under immutable identifiers.
- Preuves à conserver
- Evidence index, version history, access history and sample reconstruction test.
- Source primaire
- Decree 426 arts. 15, 19, 26
Test data, screening, reporting and retention controls.
- Action d’implémentation
- Run periodic samples and scenario tests covering identity, 25% and control BO logic, PEP duration, threshold aggregation, ROS clocks, sanctions and 15-year retention.
- Preuves à conserver
- Test plan, samples, defects, remediation owners and closure proof.
- Source primaire
- Decree 426 arts. 13, 15, 19, 24-26
Operate a dated legal-change control.
- Action d’implémentation
- Before launch and periodically thereafter check UIF, SSF, BCR, CNAD, CNR, ACE, FATF and GAFILAT sources; route changes into policy, rules, training and customer remediation.
- Preuves à conserver
- Source register, legal-change log, impact assessment and deployment record.
- Source primaire
- Decree 426 arts. 55-61; risk-based implementation control
Registre des sources primaires
12 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- Special AML/CFT/CPF Law - Decree 426Unidad de Investigación Financiera · Primary legislation
- Current-law frequently asked questionsUnidad de Investigación Financiera · Official current guidance
- UIF instructions and guidesUnidad de Investigación Financiera · Official guidance portal
- International sanctions lists portalUnidad de Investigación Financiera · Official sanctions guidance
- El Salvador 2024 mutual evaluationFATF / GAFILAT · Authoritative mutual evaluation
- FATF high-risk jurisdictions - June 2026Financial Action Task Force · Authoritative current-status statement
- FATF jurisdictions under increased monitoring - June 2026Financial Action Task Force · Authoritative current-status statement
- Registro de Comercio servicesCentro Nacional de Registros · Official company registry portal
- Personal Data Protection Law - Decree 144Asamblea Legislativa · Primary legislation
- ACE personal-data handling policiesAgencia de Ciberseguridad del Estado · Official privacy guidance
- Digital Assets Issuance Law with reformsComisión Nacional de Activos Digitales · Primary legislation
- Digital-asset service-provider registrationComisión Nacional de Activos Digitales · Official licensing guidance
Réponses directes
Questions KYC, KYB et AML pour Salvador
Who receives suspicious reports in El Salvador?+
The Unidad de Investigación Financiera (UIF), the national financial intelligence office attached to the Fiscalía General de la República.
When must a suspicious operation be reported?+
The subject has up to 15 business days from detection to analyze an unusual operation, with one equal extension available on request; after determining suspicion, the authorized report must be sent promptly and within 24 hours.
What regulated-transaction reporting applies?+
Article 25 covers linked cash, other-means, electronic-transfer and digital-asset transactions and requires reporting within five business days. The current UIF FAQ describes transitional instruction thresholds above USD 10,000 cash, USD 25,000 other means and USD 1,000 electronic transfers; confirm the applicable current sector instrument.
What is the beneficial-owner threshold?+
Identify natural persons who directly or indirectly own or control at least 25% of capital or voting rights, plus natural persons exercising control by other means.
How long must AML records be retained?+
At least 15 years. Transaction records run from transaction completion; customer identification and account files run from relationship termination or account closure.
Is the company or beneficial-ownership registry public?+
CNR provides Registro de Comercio services and certifications, but this checklist does not represent that a comprehensive public beneficial-ownership register is available. Confirm current filing fields and access with CNR and the supervisor.
Who supervises digital-asset services?+
CNAD supervises digital-asset service providers under its law and register. SSF supervises providers performing bitcoin operations under the new AML law. The exact service and territorial perimeter must be analyzed before marketing or launch.
Who is the personal-data authority?+
The Agencia de Ciberseguridad del Estado (ACE) is the governing authority under the Personal Data Protection Law and has issued handling and security policies.
Is El Salvador on a FATF public list?+
As reviewed on 6 August 2026, El Salvador was not named in FATF's June 2026 high-risk or increased-monitoring statements. Recheck both live statements before reliance.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General regulatory information, not legal advice, a licence determination or a substitute for the operative Spanish texts and current supervisor instructions. Reviewed 6 August 2026. Confirm whether replacement regulations or UIF instructions have been issued, the applicable sector reporting parameters, registry access, sanctions escalation route, privacy guidance and licensing perimeter with the UIF, relevant supervisor and qualified Salvadoran counsel before launch.