Question 1

Who receives suspicious transaction reports in Senegal?

Accepted Answer

Reporting persons submit suspicious transaction reports to CENTIF Senegal. Law No. 2024-08 requires immediate reporting of covered suspected, attempted and relevant proposed activity and supplementary information without delay.

Question 2

Can customer verification be completed after onboarding?

Accepted Answer

Only under the narrow conditions in article 18: completion as soon as possible and before the first transaction, necessity to avoid interrupting normal business, effective risk management and pre-established risk procedures. This is not a general grace period. If required CDD cannot be completed, article 25 requires the relationship or transaction to be refused or terminated as applicable and a suspicious transaction report to be submitted to CENTIF without tipping off the customer.

Question 3

How long should AML records be kept?

Accepted Answer

Core identity, KYC, profile and analysis records are retained for 10 years after account closure or the end of the relationship. Transaction, accounting and correspondence records are retained for 10 years after the transaction.

Question 4

Do fintechs need BCEAO authorisation?

Accepted Answer

A fintech providing a regulated payment service must operate within the applicable BCEAO authorisation framework. The exact requirement depends on the legal entity and service. BCEAO Notice No. 006-05-2025 extended the transition through 31 August 2025; from 1 September 2025, only authorised payment service providers could operate within the regulated perimeter.

Question 5

Is Senegal currently on the FATF grey list?

Accepted Answer

No. FATF removed Senegal from increased monitoring in October 2024, and its 19 June 2026 statement confirms that Senegal is not under increased monitoring. Firms must still apply the domestic risk-based framework and enhanced measures wherever their own risk assessment requires them.

Question 6

Does KYC data require CDP formalities?

Accepted Answer

Potentially. Organisations should classify each processing operation under Senegal's privacy framework. Sensitive or biometric processing, interconnected files and certain third-country transfers may require prior authorisation rather than a simple declaration.

حمّل قائمة KYC وKYB وAML الخاصة بـ السنغال

احصل على ملف PDF فورًا

مراجعة وموثقة بالمصادر

تحقق مرة واحدة. في كل مكان.

حمّل قائمة KYC وKYB وAML الخاصة بـ السنغال

احصل على ملف PDF فورًا

مراجعة وموثقة بالمصادر

تحقق مرة واحدة. في كل مكان.