بوروندي KYC, KYB & AML compliance checklist
قائمة عملية وموثقة بالمصادر لتنفيذ متطلبات KYC وKYB وAML في بوروندي.
- تاريخ آخر مراجعة
- تاريخ آخر مراجعة:
- الإصدار
- الإصدار 1.0
إجابة مباشرة
ما الذي تغطيه قائمة الامتثال الخاصة بـ بوروندي؟
تحوّل قائمة بوروندي قواعد KYC وKYB وAML الأساسية إلى 11 مجالات رقابية و40 فحوص تنفيذ، وتشمل الجهات المختصة وواجبات الإبلاغ والأدلة الواجب الاحتفاظ بها.
حقائق تنظيمية أساسية
- Primary AML/CFT law
- Law No. 1/08 of 27 March 2025 amending Law No. 1/02 of 4 February 2008
- Financial intelligence unit
- Cellule Nationale du Renseignement Financier (CNRF)
- STR timing
- Promptly; without delay after the statutory suspicion trigger
- Threshold reports
- CNRF or competent-authority thresholds - confirm the live instrument
- Core AML retention
- 10 years under relationship- and transaction-specific clocks
- Beneficial ownership
- Identify the natural person who ultimately owns or controls, or on whose behalf activity occurs
- Financial supervisor
- Banque de la Republique du Burundi (BRB) for BRB-supervised entities
- Privacy law
- Law No. 1/03 of 10 March 2026
- Data-breach notice
- Notify the protection body within 72 hours; high-risk individuals within 96 hours
- FATF public lists
- Not named in the June 2026 public statements
تفاصيل التنفيذ
متطلبات وإجراءات الامتثال في بوروندي
افتح كل مجال لمراجعة المتطلب وإجراء التنفيذ المقترح والأدلة الواجب الاحتفاظ بها والمصدر الأساسي.
01Scope, authorities and regulated activitiesResolve the entity, activity, supervisor and reporting perimeter before onboarding or launch.4 عناصر+
The AML/CFT law applies to listed financial institutions, public and private licensing bodies, and designated non-financial businesses and professions.
- إجراء التنفيذ
- Map each entity, product, branch, agent, distributor and outsourced function to the statutory list and document the responsible supervisor.
- الأدلة الواجب الاحتفاظ بها
- Perimeter memorandum, entity-product map, licences and supervisor correspondence.
- المصدر الأساسي
- Law No. 1/08 of 27 March 2025, arts. 1-3
CNRF is the national FIU and receives, analyses and disseminates suspicious transaction reports.
- إجراء التنفيذ
- Appoint an authorised correspondent and obtain the current CNRF form, access, submission and acknowledgement instructions before production reporting.
- الأدلة الواجب الاحتفاظ بها
- Appointment, access record, reporting procedure and test evidence.
- المصدر الأساسي
- Law No. 1/08, arts. 4-6; Decree No. 100/009 of 9 February 2026
BRB Regulation No. 02/2026 applies to credit institutions, the National Postal Service, exchange bureaux, payment institutions, financing or guarantee funds and microfinance institutions.
- إجراء التنفيذ
- Document whether each service is within a BRB-supervised category and obtain the required activity-specific approval before launch.
- الأدلة الواجب الاحتفاظ بها
- Classification, application, approval, conditions and service map.
- المصدر الأساسي
- BRB Regulation No. 02/2026, arts. 1-2
Virtual-asset services are within the AML law's defined regulated perimeter, but the reviewed sources did not establish a standalone live VASP licensing route.
- إجراء التنفيذ
- Do not launch exchange, transfer, custody or other virtual-asset activity without a written perimeter and licensing decision from BRB and other competent authorities.
- الأدلة الواجب الاحتفاظ بها
- Legal analysis, authority correspondence, licence or written no-objection and product controls.
- المصدر الأساسي
- Law No. 1/08, art. 3 definitions; controlled licensing uncertainty
02Governance, risk assessment and control ownershipBuild documented, risk-based controls with accountable governance.3 عناصر+
Reporting institutions must establish AML/CFT policies, procedures, internal controls, employee screening, training and independent control arrangements.
- إجراء التنفيذ
- Approve and periodically test a control framework covering CDD, BO, PEPs, sanctions, monitoring, reporting, records and training.
- الأدلة الواجب الاحتفاظ بها
- Policy suite, approvals, control library, training and assurance reports.
- المصدر الأساسي
- Law No. 1/08, arts. 75-76; BRB Regulation No. 02/2026, arts. 4 and 18-20
Institutions must identify and assess their ML/TF risks and apply controls proportionate to risk.
- إجراء التنفيذ
- Assess customers, countries, products, services, transactions, delivery channels and new technologies before launch and on material change.
- الأدلة الواجب الاحتفاظ بها
- Risk assessment, methodology, source data, change log and approvals.
- المصدر الأساسي
- Law No. 1/08, arts. 23-38
BRB-supervised institutions must appoint an AML/CFT officer with adequate authority, independence and access and notify BRB and CNRF.
- إجراء التنفيذ
- Approve the appointment, formal mandate, resources, escalation rights and group coverage; file required notifications.
- الأدلة الواجب الاحتفاظ بها
- Appointment, notifications, job mandate, access and board reporting.
- المصدر الأساسي
- BRB Regulation No. 02/2026, arts. 18-19
03Natural-person identification and CDDIdentify and verify customers, representatives and ultimate actors using reliable independent evidence.4 عناصر+
Regular and occasional customers, and persons acting for them, must be identified and their authority verified through independent and reliable sources.
- إجراء التنفيذ
- Capture identity attributes, verify evidence provenance, confirm mandates and establish the purpose and expected nature of activity.
- الأدلة الواجب الاحتفاظ بها
- CDD file, source provenance, verification result, authority and risk decision.
- المصدر الأساسي
- Law No. 1/08, art. 53; BRB Regulation No. 02/2026, arts. 5 and 10
Remote onboarding requires adapted identification measures and may use a reliable, independent digital-identification system.
- إجراء التنفيذ
- Authenticate documents and apply risk-calibrated independent checks, supplementary evidence and escalation without assuming one technology is legally sufficient.
- الأدلة الواجب الاحتفاظ بها
- Remote-onboarding standard, vendor review, model tests, first-payment control and exceptions.
- المصدر الأساسي
- Law No. 1/08, art. 54; BRB Regulation No. 02/2026, art. 7
Anonymous and fictitious-name accounts are prohibited.
- إجراء التنفيذ
- Block activation until the customer and required actors are identified and verified under the applicable rule.
- الأدلة الواجب الاحتفاظ بها
- Account controls, test results and rejected-case log.
- المصدر الأساسي
- Law No. 1/08, art. 52; BRB Regulation No. 02/2026, art. 5
CDD information must remain accurate and relevant during the relationship.
- إجراء التنفيذ
- Use risk-based and event-driven refreshes for identity, purpose, expected activity, ownership and authority.
- الأدلة الواجب الاحتفاظ بها
- Refresh schedule, triggers, updated files and exception testing.
- المصدر الأساسي
- Law No. 1/08, art. 65; BRB Regulation No. 02/2026, art. 5
04KYB, authority and beneficial ownershipVerify legal existence, representatives, ownership and ultimate natural-person control.4 عناصر+
Businesses and branches register through the ADB commercial register and maintain registrations for later changes.
- إجراء التنفيذ
- Obtain current registry evidence, constitutive documents, tax number, registered address, managers and representative mandates; reconcile later changes.
- الأدلة الواجب الاحتفاظ بها
- Commercial-register certificate, NIF, statutes, change filings and discrepancy log.
- المصدر الأساسي
- Commercial Code 2015, arts. 34-37; ADB official creation and modification procedures
Institutions must discover and verify the natural person who ultimately owns or controls the customer or on whose behalf a transaction occurs.
- إجراء التنفيذ
- Trace ownership and control through every layer and record the natural-person conclusion and evidence; do not substitute an undefined percentage.
- الأدلة الواجب الاحتفاظ بها
- Ownership chart, control analysis, source records and verified BO files.
- المصدر الأساسي
- Law No. 1/08, art. 3 definitions and arts. 51, 53 and 64; BRB Regulation No. 02/2026, arts. 3, 5-6
Trustees or equivalent managers must disclose that they act for others at relationship and prescribed occasional-transaction triggers.
- إجراء التنفيذ
- Identify the arrangement, trustee or manager, settlor, beneficiaries and all persons exercising ultimate control; confirm any live threshold instrument.
- الأدلة الواجب الاحتفاظ بها
- Instrument, role register, identity files, control analysis and threshold check.
- المصدر الأساسي
- Law No. 1/08, art. 55
The 2026 national risk assessment reported that Burundi did not yet have a national BO register.
- إجراء التنفيذ
- Do not represent ordinary commercial-register evidence as a verified national BO filing; monitor for a new register and reconcile when implemented.
- الأدلة الواجب الاحتفاظ بها
- Registry checks, customer-supplied ownership evidence, independent corroboration and change-monitoring log.
- المصدر الأساسي
- Burundi National Risk Assessment 2026, para. 161
05PEPs, enhanced due diligence and relianceApply stronger approval, evidence and monitoring where risk is higher.4 عناصر+
Domestic, foreign and international-organisation PEPs, close family and known associates fall within the statutory PEP framework.
- إجراء التنفيذ
- Screen customers, beneficial owners, controllers and representatives at onboarding, list updates and periodic review.
- الأدلة الواجب الاحتفاظ بها
- Screening, match rationale, relationship mapping and review record.
- المصدر الأساسي
- Law No. 1/08, art. 3 definitions 35-38
BRB-supervised institutions apply enhanced control to PEP relationships; statutory PEP status continues for two years after the relevant function ends.
- إجراء التنفيذ
- Require risk-based senior approval, source-of-wealth and source-of-funds evidence and enhanced monitoring, including after office where risk persists.
- الأدلة الواجب الاحتفاظ بها
- Source file, approval, monitoring plan and two-year status diary.
- المصدر الأساسي
- Law No. 1/08, art. 3 definition 38; BRB Regulation No. 02/2026, art. 5
Reliance on a third party does not remove the reporting institution's responsibility.
- إجراء التنفيذ
- Confirm equivalent CDD and supervision, obtain identity material without delay, contract for access and test retrieval.
- الأدلة الواجب الاحتفاظ بها
- Due diligence, agreement, retrieval test and exceptions.
- المصدر الأساسي
- Law No. 1/08, arts. 46 and 58-60; BRB Regulation No. 02/2026, arts. 8-9
Simplified identification may be allowed only in circumstances defined by the competent authority and may not override suspicion.
- إجراء التنفيذ
- Use simplified treatment only with the exact current instrument, documented lower-risk basis and a suspicion override.
- الأدلة الواجب الاحتفاظ بها
- Instrument, risk rationale, approval and monitoring.
- المصدر الأساسي
- Law No. 1/08, arts. 56 and 60
06Failed CDD, monitoring and suspicious reportingStop unsafe activity, monitor continuously and report suspicion promptly and confidentially.4 عناصر+
If doubt about the true beneficial actor persists after verification, the operation or relationship must end and suspicion must be considered for reporting.
- إجراء التنفيذ
- Operate a controlled block or exit and preserve the confidential STR decision.
- الأدلة الواجب الاحتفاظ بها
- Failure reason, block, closure, analysis, STR and acknowledgement.
- المصدر الأساسي
- Law No. 1/08, art. 64; BRB Regulation No. 02/2026, art. 6
Complex, abnormally large or unusual activity without apparent economic or lawful purpose requires examination and written documentation.
- إجراء التنفيذ
- Investigate source, destination, purpose and actors, refresh CDD and retain the confidential written analysis.
- الأدلة الواجب الاحتفاظ بها
- Alerts, cases, source evidence, report and approval.
- المصدر الأساسي
- Law No. 1/08, arts. 66-67 and 72-73; BRB Regulation No. 02/2026, art. 12
Reporting entities that suspect or reasonably suspect criminal proceeds or terrorist-financing links must report promptly to CNRF.
- إجراء التنفيذ
- Timestamp the trigger and submit using the current CNRF format and route without waiting for proof of an offence.
- الأدلة الواجب الاحتفاظ بها
- Internal report, analysis, STR, CNRF receipt and timeline.
- المصدر الأساسي
- Law No. 1/08, arts. 12-15; BRB Regulation No. 02/2026, art. 14
Suspected activity is withheld before reporting unless non-execution is impossible or would frustrate the investigation; tipping off is prohibited.
- إجراء التنفيذ
- Govern transaction holds, lawful post-execution reporting and restricted communications; escalate urgent cases to CNRF.
- الأدلة الواجب الاحتفاظ بها
- Hold decision, exception rationale, access logs and communications record.
- المصدر الأساسي
- Law No. 1/08, arts. 16-18; BRB Regulation No. 02/2026, art. 15
07Wires, thresholds, payments and agentsKeep CDD triggers, special examination and threshold reports distinct.4 عناصر+
Cash and other threshold reports apply at amounts set by CNRF or the competent authority, including apparently linked operations.
- إجراء التنفيذ
- Obtain and version-control the live CNRF and BRB threshold instruments; configure aggregation and do not invent a value from the primary law.
- الأدلة الواجب الاحتفاظ بها
- Current instrument, configuration, tests, reports, receipts and exception record.
- المصدر الأساسي
- Law No. 1/08, arts. 41 and 48; BRB Regulation No. 02/2026, arts. 3 and 13
Electronic transfers require verified originator name, account and address or alternative identity information.
- إجراء التنفيذ
- Validate required data through the chain and preserve originator and beneficiary records.
- الأدلة الواجب الاحتفاظ بها
- Field matrix, validation, repair queue, samples and decisions.
- المصدر الأساسي
- Law No. 1/08, arts. 69-70
Incoming transfers lacking complete originator information must be repaired and verified; if the information is not obtained, refuse and report to CNRF.
- إجراء التنفيذ
- Define repair, reject, suspend, investigate and report rules with auditable timelines.
- الأدلة الواجب الاحتفاظ بها
- Repair requests, reject decisions, STRs and testing.
- المصدر الأساسي
- Law No. 1/08, art. 71
Payment services and exchange activity require the applicable BRB approval and AML controls.
- إجراء التنفيذ
- Map the product, agent, outsourcing and settlement chain to the current payments and exchange rules and licence conditions.
- الأدلة الواجب الاحتفاظ بها
- Licence, conditions, agent register, oversight and audit results.
- المصدر الأساسي
- Law No. 1/07 of 11 May 2018; BRB Payment Regulation No. 002/2024; BRB Regulation No. 02/2026
08Targeted financial sanctions and proliferation riskScreen, freeze, restrict and report under the current designation framework.3 عناصر+
Funds linked to UN-designated terrorists, terrorist financiers and terrorist organisations are subject to a court-defined freeze, and holders must freeze them immediately.
- إجراء التنفيذ
- Maintain list-update, screening and rapid escalation controls and obtain competent-authority direction for the specific match.
- الأدلة الواجب الاحتفاظ بها
- List inventory, update logs, screening, match decision, freeze and legal direction.
- المصدر الأساسي
- Law No. 1/08, art. 88
Relevant designated-person funds must be reported promptly to CNRF or another competent authority.
- إجراء التنفيذ
- Notify through the current route, preserve the receipt and do not release or deal without written authority.
- الأدلة الواجب الاحتفاظ بها
- Notification, receipt, direction and release decision.
- المصدر الأساسي
- Law No. 1/08, art. 89
The reviewed AML statute is framed principally around ML and TF; CPF implementation details require separate confirmation.
- إجراء التنفيذ
- Screen applicable UN proliferation designations and obtain current Burundi implementation and reporting instructions before dealing.
- الأدلة الواجب الاحتفاظ بها
- Legal update, screening records, authority correspondence and escalation decision.
- المصدر الأساسي
- Controlled uncertainty; CNRF 2026 mutual-evaluation materials
09Records, access and assuranceRetain reconstructable records under the correct statutory clock.3 عناصر+
CDD, account, correspondence, identity, BO and analysis records are retained for 10 years after the business relationship ends.
- إجراء التنفيذ
- Map every record class to the relationship-based clock and apply legal holds.
- الأدلة الواجب الاحتفاظ بها
- Retention schedule, configuration, sample and deletion test.
- المصدر الأساسي
- Law No. 1/08, art. 47(1); BRB Regulation No. 02/2026, art. 11
Domestic and international transaction data sufficient to reconstruct each operation are retained for 10 years after execution.
- إجراء التنفيذ
- Use transaction-based clocks and retain amount, currency, actors, accounts and supporting evidence.
- الأدلة الواجب الاحتفاظ بها
- Archive configuration, reconstruction test and retrieval log.
- المصدر الأساسي
- Law No. 1/08, art. 47(2)
Required information must be readily accessible to CNRF and other competent authorities.
- إجراء التنفيذ
- Index linked identity, transaction, investigation and reporting evidence and test controlled export.
- الأدلة الواجب الاحتفاظ بها
- Request register, retrieval tests, access log and response package.
- المصدر الأساسي
- Law No. 1/08, arts. 47 and 74
10Privacy, biometrics, breaches and transfersApply Law No. 1/03 of 10 March 2026 alongside mandatory AML processing.5 عناصر+
Personal-data processing must be lawful, fair, purpose-limited, proportionate, accurate, time-limited and secure.
- إجراء التنفيذ
- Inventory KYC, BO, screening, monitoring and reporting data and document purpose, legal basis, access, recipients and retention.
- الأدلة الواجب الاحتفاظ بها
- Processing register, basis assessment, notices, access matrix and retention map.
- المصدر الأساسي
- Law No. 1/03 of 10 March 2026, arts. 5-8
Biometric identification and other sensitive-data processing are prohibited unless an Article 10 exception applies, with additional safeguards.
- إجراء التنفيذ
- Before facial, fingerprint, liveness-template or comparable biometric use, document the exact exception, necessity, security and any required impact assessment and authorisation.
- الأدلة الواجب الاحتفاظ بها
- Legal assessment, explicit consent where applicable, DPIA, authorisation, encryption and access tests.
- المصدر الأساسي
- Law No. 1/03, arts. 9-10 and 40-41
High-risk processing requires a prior DPIA and submission to the protection body with an authorisation request.
- إجراء التنفيذ
- Complete the legal and technical risk analysis, obtain DPO review and do not deploy until the prescribed authorisation process is complete.
- الأدلة الواجب الاحتفاظ بها
- DPIA, DPO opinion, application, authority decision and remediation.
- المصدر الأساسي
- Law No. 1/03, arts. 40-41
Transfers abroad require an adequate destination or safeguards approved by Burundi's personal-data protection body.
- إجراء التنفيذ
- Map every hosting, support and vendor destination and obtain the required adequacy or safeguards decision before transfer.
- الأدلة الواجب الاحتفاظ بها
- Transfer map, adequacy analysis, safeguards, approval and access logs.
- المصدر الأساسي
- Law No. 1/03, arts. 15-16
A qualifying breach is notified to the protection body within 72 hours; affected individuals are notified within 96 hours where high risk arises.
- إجراء التنفيذ
- Run a documented breach triage clock, preserve the risk analysis and issue clear notifications with consequences and mitigation.
- الأدلة الواجب الاحتفاظ بها
- Incident log, discovery time, risk assessment, notices, receipts and remediation.
- المصدر الأساسي
- Law No. 1/03, arts. 45-46
11Practical evidence packs and change controlMake every acceptance, escalation and regulatory decision reconstructable.2 عناصر+
A complete customer file links identity, KYB, BO, screening, risk, approval, monitoring and reporting decisions.
- إجراء التنفيذ
- Block activation where mandatory evidence or approval is missing and preserve the release decision.
- الأدلة الواجب الاحتفاظ بها
- Control checklist, linked file, approvals and release log.
- المصدر الأساسي
- Law No. 1/08, arts. 47, 51-76
Thresholds, reporting routes, sanctions directions, registers, licences and privacy implementation are time-sensitive.
- إجراء التنفيذ
- Assign owners to monitor CNRF, BRB, ADB, the personal-data protection body, FATF and ESAAMLG on a documented schedule.
- الأدلة الواجب الاحتفاظ بها
- Legal inventory, source log, change assessment and implementation tickets.
- المصدر الأساسي
- Official sources listed below
سجل المصادر الأساسية
14 مصدرًا مستخدمًا في هذه القائمة
استخدم هذه الروابط للتحقق من التشريعات وإرشادات الجهات الرقابية وإجراءات الإبلاغ والبيانات الدولية.
- Law No. 1/08 of 27 March 2025 amending the AML/CFT lawCNRF Burundi · Primary legislation
- CNRF official portalCNRF Burundi · Official FIU portal
- Decree No. 100/009 of 9 February 2026 on the CNRFMinistry of Finance, Burundi · Primary executive instrument
- BRB Regulation No. 02/2026 on AML/CFTBanque de la Republique du Burundi · Primary regulator rule
- BRB announcement of the 2026 AML/CFT frameworkBanque de la Republique du Burundi · Official regulator guidance
- Law No. 1/03 of 10 March 2026 on personal-data protectionARCT Burundi · Primary legislation
- Official publication page for the 2026 personal-data lawARCT Burundi · Official legal publication
- Burundi National Risk Assessment 2026CNRF Burundi · Official national risk assessment
- Official company-creation procedureAgence de Developpement du Burundi · Official registry procedure
- Burundi Commercial Code 2015Agence de Developpement du Burundi · Primary commercial legislation
- Burundi mutual-evaluation statusFATF · Authoritative assessment index
- Burundi draft mutual-evaluation report review - July 2026CNRF Burundi · Official evaluation status
- Jurisdictions under Increased Monitoring - 19 June 2026FATF · Authoritative public statement
- High-Risk Jurisdictions subject to a Call for Action - 19 June 2026FATF · Authoritative public statement
إجابات مباشرة
أسئلة KYC وKYB وAML في بوروندي
Who receives suspicious transaction reports in Burundi?+
The Cellule Nationale du Renseignement Financier (CNRF) receives STRs using its current prescribed format and route.
When is an STR due?+
Promptly and without delay once the entity suspects or has reasonable grounds to suspect the statutory criminal-proceeds or terrorist-financing connection.
What transaction-reporting threshold applies?+
The AML law delegates cash and other reporting thresholds to CNRF or another competent authority. Obtain the current instrument and do not infer a universal value from the statute.
What beneficial-ownership test applies?+
Identify the natural person who ultimately owns or controls the customer, or on whose behalf a transaction occurs. The reviewed primary law does not provide a universal ownership percentage.
Does Burundi have a national beneficial-owner register?+
The official 2026 national risk assessment reported that a national BO register was not yet in place. Continue independent ownership and control verification and monitor implementation.
How long are AML records kept?+
CDD and relationship records are kept for 10 years after the relationship ends; reconstructable transaction data are kept for 10 years after execution.
Do remote onboarding and biometrics need extra controls?+
Yes. Remote onboarding requires adapted reliable identification. Biometric identification is sensitive processing and requires a supported exception, safeguards, and potentially a DPIA and authorisation.
What privacy breach deadlines apply?+
Notify the personal-data protection body within 72 hours of awareness of a qualifying breach, and notify affected individuals within 96 hours where the breach may create a high risk.
Is Burundi on a FATF public list?+
No. Burundi was not named in FATF's June 2026 increased-monitoring or call-for-action statements. Its ESAAMLG mutual evaluation was still being finalised as at 27 July 2026.
منهجية البحث والمراجعة
تحدد VOVE ID Compliance Research النطاق التنظيمي، وتحول الالتزامات إلى ضوابط تشغيلية، وتربط الادعاءات الجوهرية بالمصادر، وتسجل تاريخ وإصدار كل مراجعة.
This checklist is general regulatory information, not legal advice or a licence determination. It reflects primary and authoritative materials reviewed on 27 July 2026. Confirm current CNRF forms, access and threshold instruments; BRB circulars and licence conditions; sanctions directions; company and beneficial-ownership filing developments; personal-data agency implementation; and all sector overlays with the competent authority and qualified Burundian counsel before launch.