Cambodia KYC, KYB & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Cambodia.
- Last reviewed
- Last reviewed:
- Version
- Version 1.1
Portable implementation guide
Get the PDF checklist
11 control areas · 38 implementation checks
Last reviewed: 11 November 2026 · Version 1.1
Download the checklistDirect answer
What does the Cambodia compliance checklist cover?
The Cambodia checklist translates primary KYC, KYB and AML rules into 11 control areas and 38 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- Primary AML law
- Law on AML/CFT, Royal Kram NS/RKM/0620/021 (2020)
- FIU
- Cambodia Financial Intelligence Unit (CAFIU)
- Suspicious reporting
- Promptly and within 24 hours
- Beneficial owner
- 20% ownership/voting interest, other control, then senior-management fallback
- Cash reports
- CAFIU-prescribed sector threshold; aggregate connected transactions
- Records
- At least 5 years after closure or relationship end
- CAFIU hold
- Written/confirmed direction for up to 48 hours
- FATF public lists
- Not listed at 30 October 2026
Implementation detail
Cambodia compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities, and licensingClassify every activity and supervisor before launch.3 items+
Determine whether each service is a reporting-entity activity.
- Implementation action
- Map banking, securities, insurance, microfinance, leasing, exchange, remittance, trust, real-estate, professional, casino, precious-metals and designated activities to the statutory perimeter.
- Evidence to retain
- Perimeter memo, service map and authority register.
- Primary citation
- AML/CFT Law, Articles 4-5
Obtain required licences or registrations.
- Implementation action
- Confirm NBC, SERC, CGMC, Ministry of Commerce or other competent-authority approval before providing a regulated financial, payment, gambling, e-commerce or trust service.
- Evidence to retain
- Licence matrix, approvals and conditions.
- Primary citation
- Applicable sector laws and regulations
Use CAFIU and the correct sector supervisor.
- Implementation action
- Maintain current filing, escalation and supervisory contacts for each regulated activity.
- Evidence to retain
- Authority map, portal access and acknowledgements.
- Primary citation
- AML/CFT Law, Articles 21-23 and 29
02Governance and risk assessmentControls must be risk-based, governed and tested.3 items+
Assess institutional and customer ML/TF risks.
- Implementation action
- Assess customer, geography, product, service, channel, transaction and technology risks and refresh after material change.
- Evidence to retain
- Methodology, assessments, approvals and remediation.
- Primary citation
- AML/CFT Law, Article 8(1)-(3)
Maintain an AML/CFT prevention programme.
- Implementation action
- Document policies, controls, senior compliance leadership, employee screening, training and independent audit proportionate to risk.
- Evidence to retain
- Programme, appointment, training and audit reports.
- Primary citation
- AML/CFT Law, Articles 16-18
Apply group-wide controls where relevant.
- Implementation action
- Extend lawful information-sharing and consistent preventive controls to branches and majority-owned subsidiaries, resolving conflicts with host-country law.
- Evidence to retain
- Group standard, conflict analysis and testing.
- Primary citation
- AML/CFT Law, Article 8(13); CAFIU internal-controls directive
03Natural-person identificationCDD is required before relationships and defined occasional transactions.4 items+
Identify and verify the customer.
- Implementation action
- Obtain minimum identity particulars and verify them with reliable independent documents, data or information before establishing the relationship.
- Evidence to retain
- Identity record, verification result and provenance.
- Primary citation
- AML/CFT Law, Article 8(4)-(5)
Apply CDD for occasional transactions, suspicion and doubt.
- Implementation action
- Apply the current CAFIU threshold for the relevant transaction; apply CDD regardless of amount where suspicion exists or prior data is doubtful.
- Evidence to retain
- Threshold version, trigger log and CDD record.
- Primary citation
- AML/CFT Law, Article 8(4)
Record purpose and intended nature and monitor continuously.
- Implementation action
- Build an expected-activity profile, scrutinize transactions and keep customer data current, especially for higher-risk customers.
- Evidence to retain
- Profile, risk decision, monitoring and refresh history.
- Primary citation
- AML/CFT Law, Article 8(5)(c)-(e)
Refuse or terminate when required CDD cannot be completed.
- Implementation action
- Do not open, commence or perform; terminate an existing relationship unless CAFIU directs otherwise, and consider an STR.
- Evidence to retain
- Failure record, decision and STR assessment.
- Primary citation
- AML/CFT Law, Article 8(6)-(7)
04KYB and beneficial ownershipVerify existence, authority, ownership and actual control.4 items+
Verify legal persons and arrangements.
- Implementation action
- Obtain registration, constitutional, tax, address, management, representation and ownership/control evidence from reliable sources.
- Evidence to retain
- Registry extract, governing documents and validation.
- Primary citation
- AML/CFT Law, Article 8(5)(a)-(b)
Apply the beneficial-owner cascade.
- Implementation action
- Identify natural persons holding directly or indirectly 20% or more of shares or voting rights, then persons controlling by other means; if none is identified, record the senior managing official fallback.
- Evidence to retain
- Ownership chart, control analysis and verified identities.
- Primary citation
- AML/CFT Law, Articles 3(10) and 8(5)(b); CAFIU FAQ
Identify representatives and validate authority.
- Implementation action
- Verify each person acting for the customer and authenticate the mandate before accepting instructions.
- Evidence to retain
- Representative KYC, mandate and verification.
- Primary citation
- CAFIU Customer Due Diligence Directive
Reconcile registry and customer information.
- Implementation action
- Compare Ministry of Commerce records and customer evidence; investigate discrepancies and do not rely solely on self-declaration.
- Evidence to retain
- Registry result, discrepancy log and resolution.
- Primary citation
- Law on Commercial Enterprises; AML/CFT Law, Article 8
05PEPs, EDD, and remote onboardingHigher-risk relationships require enhanced controls.3 items+
Identify PEPs, family members and close associates.
- Implementation action
- Screen customers and beneficial owners and apply the current risk-based approval, source-of-wealth/source-of-funds and monitoring measures.
- Evidence to retain
- Screening, classification, approval and corroboration.
- Primary citation
- AML/CFT Law, Articles 3(11) and 8(5), 8(10)
Apply enhanced due diligence to higher risk.
- Implementation action
- Collect additional identity, ownership, purpose, source and transaction evidence and increase monitoring for high-risk relationships and jurisdictions.
- Evidence to retain
- EDD checklist, approval and monitoring plan.
- Primary citation
- AML/CFT Law, Article 8(10)-(14)
Control non-face-to-face onboarding.
- Implementation action
- Apply enhanced measures, authentication, fraud controls and documented method testing where identification is not face to face.
- Evidence to retain
- Method assessment, session record and tests.
- Primary citation
- AML/CFT Law, Article 10(1)(e); CAFIU CDD Directive
06Monitoring and suspicious reportingDetection, escalation and filing must preserve the statutory clock.4 items+
Monitor complex, unusual and economically unexplained activity.
- Implementation action
- Obtain additional information on source, destination, purpose and parties and document the outcome.
- Evidence to retain
- Alerts, analysis, supporting information and decision.
- Primary citation
- AML/CFT Law, Article 10
Report suspicious transactions and attempts to CAFIU within 24 hours.
- Implementation action
- Start the clock when suspicion or reasonable grounds arise; file promptly through the prescribed current channel and preserve acknowledgement.
- Evidence to retain
- Suspicion timestamp, STR, receipt and chronology.
- Primary citation
- AML/CFT Law, Articles 3(7), 12(2)-(4) and 13
Comply with a CAFIU transaction-hold direction.
- Implementation action
- Prevent execution for the directed period, not exceeding 48 hours, and preserve the oral/written direction and release basis.
- Evidence to retain
- Hold timestamp, direction, controls and release record.
- Primary citation
- AML/CFT Law, Article 12(5)
Prevent tipping off and protect reports.
- Implementation action
- Restrict access and communications concerning STRs and related information except as CAFIU authorizes.
- Evidence to retain
- Access logs, communication controls and training.
- Primary citation
- AML/CFT Law, Article 15
07Cash reports, wires, payments, and cryptoassetsKeep threshold reporting and product authorization distinct.5 items+
Configure the applicable cash-reporting threshold.
- Implementation action
- Use the current CAFIU directive and sector scope; aggregate connected cash transactions and do not invent a universal amount.
- Evidence to retain
- Dated threshold table, rules, tests and reports.
- Primary citation
- AML/CFT Law, Articles 3(8) and 12(1)
Detect structuring below thresholds.
- Implementation action
- Identify linked transactions designed to avoid identification or reporting and apply CDD and suspicious-reporting controls.
- Evidence to retain
- Aggregation logic, alerts and decisions.
- Primary citation
- AML/CFT Law, Article 9 and 12(1)
Carry and screen required wire information.
- Implementation action
- Apply the CAFIU directive to originator, beneficiary, intermediary, missing-data, agent and record controls for the institution's role.
- Evidence to retain
- Field matrix, samples, screening and repair queue.
- Primary citation
- CAFIU Directive on Remittance and Wire Transfer (2022)
Obtain payment-service authorization before launch.
- Implementation action
- Classify the service under current NBC instruments and obtain the relevant licence, approval or registration before operation.
- Evidence to retain
- Product memo, NBC decision and conditions.
- Primary citation
- NBC payment-system and payment-service instruments
Apply current cryptoasset restrictions precisely.
- Implementation action
- For an NBC-supervised institution, map each activity and asset category to the 26 December 2024 Prakas and obtain required prior approval; do not imply a general VASP licence while the national framework remains under development.
- Evidence to retain
- Classification, approval analysis and controls.
- Primary citation
- NBC Prakas on Transaction Related to Cryptoassets (2024); CAFIU 2026 updates
08Targeted financial sanctions and CPFUse current designations and documented freeze/report procedures.3 items+
Screen current UN and Cambodian designations.
- Implementation action
- Screen customers, beneficial owners, representatives and transactions at onboarding, on list updates and throughout relationships.
- Evidence to retain
- List version, logs and match decisions.
- Primary citation
- AML/CFT Law, Article 8(15); applicable TFS instruments
Freeze covered property without delay when legally required.
- Implementation action
- Apply the operative terrorism or proliferation-financing measure, block dealing and report through the prescribed authority route.
- Evidence to retain
- Designation, freeze timestamp, asset inventory and report.
- Primary citation
- Law on Combating Financing of Proliferation of WMD (2020); TFS sub-decrees
Control false positives, permitted access and unfreezing.
- Implementation action
- Release or permit access only on documented competent-authority or court authority and preserve every condition.
- Evidence to retain
- Authority decision, conditions and release record.
- Primary citation
- Applicable TFS and frozen-property procedures
09Records and authority accessRecords must reconstruct customers, decisions and transactions.3 items+
Retain customer and transaction records for at least five years.
- Implementation action
- Run the period from account closure or relationship end and retain enough detail to reconstruct each transaction.
- Evidence to retain
- Retention schedule, archive and retrieval test.
- Primary citation
- AML/CFT Law, Article 11
Retain reports, analyses and non-reporting rationale.
- Implementation action
- Preserve cash and suspicious reports, supporting material and documented alert dispositions under the applicable period and lawful holds.
- Evidence to retain
- Case archive, rationale and integrity controls.
- Primary citation
- AML/CFT Law, Articles 11-13
Produce information lawfully to CAFIU and supervisors.
- Implementation action
- Operate controlled retrieval and disclosure workflows; do not invoke banking or professional secrecy to obstruct lawful AML/CFT access.
- Evidence to retain
- Request log, production, approval and receipt.
- Primary citation
- AML/CFT Law, Articles 6, 22-23
10Privacy, biometrics, incidents, and transfersApply current sector and e-commerce duties without assuming a comprehensive privacy statute.3 items+
Map applicable data-protection duties by activity.
- Implementation action
- Document the Electronic Commerce Law and applicable banking, telecom, consumer, cybersecurity, contractual and confidentiality duties; monitor the developing general personal-data framework.
- Evidence to retain
- Legal map, notices, purposes and change log.
- Primary citation
- Law on Electronic Commerce (2019); applicable sector rules
Protect identity and biometric data proportionately.
- Implementation action
- Minimize collection, restrict access, secure storage and transmission, test vendors and document retention/deletion without claiming a universal biometric rule.
- Evidence to retain
- Data inventory, security assessment, access logs and vendor controls.
- Primary citation
- Electronic Commerce Law and applicable sector/confidentiality duties
Manage incidents and cross-border processing under applicable rules.
- Implementation action
- Maintain detection, containment, assessment, evidence and notification workflows; confirm sector-specific requirements and safeguards before transfer.
- Evidence to retain
- Incident plan, transfer map, assessments and contracts.
- Primary citation
- Applicable Cambodian sector and cybersecurity instruments
11Practical evidence packsEvidence must reconstruct decisions end to end.3 items+
Maintain an onboarding pack.
- Implementation action
- Bundle identity, authority, KYB, beneficial ownership, PEP, sanctions, purpose, risk and approvals.
- Evidence to retain
- Complete sample and retrieval result.
- Primary citation
- Operational control supporting AML/CFT Law, Article 8
Maintain reporting and sanctions case packs.
- Implementation action
- Link trigger, classification, decision time, filing, receipt, hold/freeze, confidentiality and authority communications.
- Evidence to retain
- Case pack, timeline and access record.
- Primary citation
- AML/CFT Law, Articles 12-15; CPF framework
Maintain a launch and legal-change pack.
- Implementation action
- Record perimeter, licences, thresholds, reporting, sanctions, privacy, vendors, source versions and control tests.
- Evidence to retain
- Signed pack, source register and approvals.
- Primary citation
- Official sources listed below
Primary-source register
15 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- Law on Anti-Money Laundering and Combating Financing of TerrorismCAFIU · Primary legislation - official English translation
- CAFIU laws and regulations indexCAFIU · Official legal and regulatory index
- Compilation of CAFIU implementation directivesCAFIU · Official directives
- CAFIU implementation FAQCAFIU · Official implementation guidance
- Law on Combating Financing of Proliferation of WMDCAFIU · Primary legislation - official English translation
- Second National Risk Assessment 2026CAFIU · Official national risk assessment
- National Bank of Cambodia legislation indexNational Bank of Cambodia · Official regulatory index
- National Bank of Cambodia Banking CodeNational Bank of Cambodia · Official sector legal compilation
- Online Business RegistrationRoyal Government of Cambodia · Official company-registration service
- Electronic-commerce legal instrumentsKhmerSME / Royal Government of Cambodia · Official government legal resources
- SERC virtual-asset framework updateSecurities and Exchange Regulator of Cambodia · Official regulatory update
- FATF removal from increased monitoring - February 2023FATF · Authoritative public-list status
- FATF increased-monitoring statement - October 2026FATF · Authoritative current public-list status
- FATF call-for-action statement - October 2026FATF · Authoritative current public-list status
- Mutual Evaluation of CambodiaFATF / APG · Authoritative mutual evaluation index
Direct answers
Cambodia KYC, KYB and AML questions
Who receives AML reports?+
The Cambodia Financial Intelligence Unit (CAFIU).
When must suspicion be reported?+
Promptly and within 24 hours after suspicion or reasonable grounds arise.
Is there one universal cash-reporting amount?+
No amount should be assumed universally; use the current CAFIU directive and sector scope and aggregate connected transactions.
How is a beneficial owner identified?+
Apply the 20% direct or indirect ownership/voting-interest test, then control by other means, then the senior managing official fallback.
How long are AML records retained?+
At least five years after account closure or the end of the business relationship, subject to lawful longer holds.
Can CAFIU stop a transaction?+
CAFIU may direct a reporting entity not to proceed for a specified period not exceeding 48 hours under Article 12(5).
Are cryptoasset services generally licensed?+
NBC-supervised institutions must follow the 2024 Prakas and obtain required approval for covered activities; Cambodia's broader virtual-asset framework remained under development at review.
Is Cambodia on a FATF public list?+
No at 30 October 2026. Cambodia remains an APG member and public-list absence is not a low-risk determination.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General information, not legal advice. Reviewed 11 November 2026. Confirm the controlling Khmer text, current CAFIU directives, reporting portal specifications, sector thresholds, live sanctions measures, privacy duties and product licensing with the competent authority and qualified Cambodian counsel.