Central African Republic KYC, KYB & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Central African Republic.
- Last reviewed
- Last reviewed:
- Version
- Version 1.0
Direct answer
What does the Central African Republic compliance checklist cover?
The Central African Republic checklist translates primary KYC, KYB and AML rules into 11 control areas and 32 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- FIU
- Agence Nationale d'Investigation Financière (ANIF)
- Primary AML rule
- CEMAC Regulation No. 02/24
- Suspicion reporting
- Forthwith to ANIF; oral or electronic reports require written confirmation within 48 hours
- Cash reporting
- CFA 5,000,000 or more, single or apparently linked, subject to stated exceptions
- Core retention
- 10 years for financial-institution CDD and transaction records
- FATF status
- Not named on FATF public lists as at 19 June 2026
Implementation detail
Central African Republic compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities, and licensingResolve the entity, activity and supervisor before launch.3 items+
Determine whether each activity is a CEMAC reporting entity.
- Implementation action
- Map every entity, product, channel and agent to the financial-institution or DNFBP categories and identify ANIF and the competent sector supervisor.
- Evidence to retain
- Applicability memo, product map and accountable-owner register.
- Primary citation
- CEMAC Regulation No. 02/24, Articles 6-7
Treat ANIF as the national financial intelligence unit.
- Implementation action
- Register the required correspondents, obtain the current reporting format and test a controlled filing path before operations begin.
- Evidence to retain
- Correspondent notice, channel test, procedure and access approvals.
- Primary citation
- CEMAC Regulation No. 02/24, Articles 86-97 and 107-109
Obtain authorisation before regulated banking, microfinance, insurance, payment, exchange or other financial activity.
- Implementation action
- Classify each service with the competent national authority, COBAC, BEAC or other supervisor and obtain every approval before launch.
- Evidence to retain
- Perimeter analysis, authority correspondence and licence register.
- Primary citation
- Applicable CEMAC, COBAC, BEAC, CIMA and national sector rules
02Governance and risk assessmentThe programme must be documented, risk-based and independently tested.3 items+
Maintain an enterprise-wide ML/TF/PF risk assessment.
- Implementation action
- Assess customers, products, channels, geography, cash, agents, technology and proliferation risk before launch and on material change.
- Evidence to retain
- Approved methodology, risk assessment, controls and version history.
- Primary citation
- CEMAC Regulation No. 02/24, risk-based obligations
Maintain written controls and an empowered compliance function.
- Implementation action
- Assign senior accountability, confidential ANIF reporting authority, resources, training and independent testing.
- Evidence to retain
- Appointments, policies, training, testing and remediation log.
- Primary citation
- CEMAC Regulation No. 02/24, internal-control and correspondent provisions
Assess new technology before use.
- Implementation action
- Identify and mitigate ML/TF/PF risks before launching a new product, distribution mechanism or technology.
- Evidence to retain
- Pre-launch assessment, approval, tests and residual-risk acceptance.
- Primary citation
- CEMAC Regulation No. 02/24, Article 25
03Natural-person identificationCDD uses reliable, independent evidence and continues through the relationship.3 items+
Identify and verify customers and representatives.
- Implementation action
- Verify the customer with reliable independent evidence; identify anyone acting for the customer and verify their authority.
- Evidence to retain
- Identity file, source provenance, mandate and verification result.
- Primary citation
- CEMAC Regulation No. 02/24, Articles 20 and 29-30
Understand purpose and expected activity.
- Implementation action
- Record the relationship purpose, products, expected volumes, counterparties, geography and source of funds sufficient for risk rating and monitoring.
- Evidence to retain
- Customer profile, expected-activity baseline and approval.
- Primary citation
- CEMAC Regulation No. 02/24, Article 21
Do not proceed where mandatory CDD fails.
- Implementation action
- Do not open or execute, or terminate as applicable, when required identification cannot be completed; consider and confidentially file an STR.
- Evidence to retain
- Decline or exit decision, investigation and restricted STR record.
- Primary citation
- CEMAC Regulation No. 02/24, Article 41
04KYB, registries, and beneficial ownershipRegistry evidence does not replace natural-person ownership and control analysis.3 items+
Verify legal existence, governance and authority.
- Implementation action
- Obtain current RCCM, constitutional, address, director, signatory, tax and licence evidence and reconcile inconsistencies.
- Evidence to retain
- RCCM extract, statutes, powers, tax record and licence file.
- Primary citation
- CEMAC Regulation No. 02/24, Article 31; OHADA Uniform Acts
Identify natural-person beneficial owners through ownership, control and fallback tests.
- Implementation action
- Identify the natural persons with ultimate controlling interests, then control by other means, and use the principal-manager fallback only where no person is identified under the first two tests.
- Evidence to retain
- Ownership chart, source records, control analysis and verified identities.
- Primary citation
- CEMAC Regulation No. 02/24, Article 33
Apply the register disclosure test separately from AML CDD.
- Implementation action
- For the CEMAC register, capture declared beneficial owners; if none is declared, apply the Regulation's more-than-25% and specified control or officeholder rules. Do not substitute this fallback for Article 33 CDD.
- Evidence to retain
- Register filing, calculation, officeholder record and reconciliation.
- Primary citation
- CEMAC Regulation No. 02/24, Articles 76-82
05PEPs, EDD, and remote onboardingHigher-risk and remote relationships require enhanced controls.3 items+
Detect PEP exposure in customers and beneficial owners.
- Implementation action
- Use appropriate systems to identify domestic, foreign and international-organisation PEP exposure and connected-person risk.
- Evidence to retain
- Screening, relationship map, match decision and refresh log.
- Primary citation
- CEMAC Regulation No. 02/24, Articles 23 and 67
Apply PEP approval, provenance and monitoring measures.
- Implementation action
- Obtain senior-management approval, take reasonable measures to establish source of funds or assets, and conduct enhanced ongoing monitoring.
- Evidence to retain
- Approval, provenance analysis and monitoring plan.
- Primary citation
- CEMAC Regulation No. 02/24, Article 23
Control non-face-to-face risk.
- Implementation action
- Apply enhanced identity, fraud, device, liveness and exception controls proportionate to the remote channel and data used.
- Evidence to retain
- Remote-onboarding assessment, vendor review, tests and exceptions.
- Primary citation
- CEMAC Regulation No. 02/24, Article 22; Law No. 24.001
06Monitoring and suspicious reportingANIF reporting is prompt, traceable and confidential.3 items+
Monitor activity against the current customer profile.
- Implementation action
- Examine unusual, complex, linked or apparently purposeless activity and preserve a reasoned conclusion.
- Evidence to retain
- Alerts, investigation, disposition and rule governance.
- Primary citation
- CEMAC Regulation No. 02/24, Articles 21 and 63-64
Report suspicious and attempted transactions forthwith to ANIF.
- Implementation action
- File when the entity knows, suspects or has good reason to suspect criminal proceeds or ML/TF/PF; confirm a telephone or electronic report in writing within 48 hours.
- Evidence to retain
- Decision chronology, report, receipt and supplemental-information log.
- Primary citation
- CEMAC Regulation No. 02/24, Articles 105 and 109
Prevent tipping off.
- Implementation action
- Restrict access and do not disclose an STR, its content or ANIF action to the customer or unauthorised third parties.
- Evidence to retain
- Access logs, confidentiality procedure and training.
- Primary citation
- CEMAC Regulation No. 02/24, Article 110
07Payments, wires, thresholds, and agentsPayment controls preserve required data and apply scoped objective reporting.3 items+
Report covered cash transactions of CFA 5,000,000 or more.
- Implementation action
- Aggregate single and apparently linked cash transactions and report to ANIF, applying only the express business-use and BEAC-counter exceptions while retaining enhanced scrutiny.
- Evidence to retain
- Aggregation tests, exception basis, filing and receipt.
- Primary citation
- CEMAC Regulation No. 02/24, Article 18
Preserve required wire-transfer information.
- Implementation action
- Carry required originator and beneficiary data through the payment chain; seek missing data and, if not obtained within three days, refrain from execution and inform ANIF.
- Evidence to retain
- Message sample, exception workflow, request and ANIF notice.
- Primary citation
- CEMAC Regulation No. 02/24, Articles 36-38
Retain accountability for agents and outsourcing.
- Implementation action
- Verify permissions, diligence providers, contract for security and record access, train agents, monitor performance and test retrieval.
- Evidence to retain
- Due diligence, contract, training, monitoring and retrieval test.
- Primary citation
- Applicable Regulation No. 04/18 and COBAC rules
08Targeted financial sanctionsUse the current CEMAC sanctions framework and controlled national procedures.3 items+
Screen applicable UN, regional and national designations.
- Implementation action
- Screen customers, beneficial owners, controllers, representatives and transactions at onboarding, list updates and before relevant execution.
- Evidence to retain
- List inventory, update logs, screening configuration and dispositions.
- Primary citation
- CEMAC Regulation No. 04/24; UN Security Council Consolidated List
Freeze covered property without delay or prior notice.
- Implementation action
- Prevent prohibited movement or availability of covered funds and economic resources and escalate immediately under the competent national process.
- Evidence to retain
- Freeze procedure, timestamps, legal basis and authority communication.
- Primary citation
- CEMAC Regulation No. 04/24
Report and govern matches, false positives and release.
- Implementation action
- Make required reports within the applicable 24-hour and quarterly periods, file an STR where required, and release only on documented lawful authority.
- Evidence to retain
- Reports, ANIF receipt, match rationale, authority instruction and reconciliation.
- Primary citation
- CEMAC Regulation No. 04/24
09Records and regulator accessRecords must reconstruct the customer, ownership, transaction and decision.3 items+
Retain financial-institution CDD records for at least 10 years.
- Implementation action
- Retain identification and relationship records for at least 10 years after account closure or relationship end, subject to longer legal holds.
- Evidence to retain
- Schedule, configuration, archive sample and legal-hold log.
- Primary citation
- CEMAC Regulation No. 02/24, Article 39
Retain transaction records for at least 10 years.
- Implementation action
- Preserve transaction, accounting, correspondence and special-examination records for at least 10 years after the transaction.
- Evidence to retain
- Transaction reconstruction, storage control and retrieval test.
- Primary citation
- CEMAC Regulation No. 02/24, Articles 39-40 and 64
Respond securely to competent-authority requests.
- Implementation action
- Authenticate requests, protect STR confidentiality, produce reproducibly and log scope, timing and receipt.
- Evidence to retain
- Request, approval, production index and acknowledgement.
- Primary citation
- CEMAC Regulation No. 02/24, Articles 40 and 97
10Privacy, biometrics, and transfersApply the new national data-protection law while confirming implementing procedures.3 items+
Document a lawful, necessary and transparent basis for identity processing.
- Implementation action
- Map purposes, data, notices, rights, recipients, security and retention under Law No. 24.001 and applicable AML secrecy rules.
- Evidence to retain
- Data inventory, legal-basis assessment, notices and rights procedure.
- Primary citation
- Law No. 24.001 on personal-data protection
Apply enhanced safeguards to biometric and sensitive data.
- Implementation action
- Minimise collection, restrict access, test security and document necessity and proportionality before biometric or sensitive-data use.
- Evidence to retain
- Impact assessment, security tests, access controls and approval.
- Primary citation
- Law No. 24.001 on personal-data protection
Confirm transfer, breach and authority procedures before production use.
- Implementation action
- Obtain current implementing instruments and competent-authority guidance before configuring international transfers, registrations or breach notices; do not invent a portal or deadline.
- Evidence to retain
- Dated legal update, authority guidance and implemented procedure.
- Primary citation
- Law No. 24.001; current implementing instruments
11Practical evidence packsMaintain concise packs that reproduce decisions and support supervisory access.2 items+
Maintain a reconstructable onboarding pack.
- Implementation action
- Bundle identity, KYB, beneficial ownership, screening, risk, approvals and exceptions under stable identifiers.
- Evidence to retain
- Complete sampled onboarding pack.
- Primary citation
- Operational control supporting CEMAC Regulation No. 02/24
Maintain a reconstructable monitoring and reporting pack.
- Implementation action
- Link transactions, alerts, analysis, approvals, reports and post-filing controls while protecting confidentiality.
- Evidence to retain
- Complete sampled case pack and access log.
- Primary citation
- Operational control supporting CEMAC Regulation No. 02/24, Articles 105-110
Primary-source register
10 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- CEMAC Regulation No. 02/24 - AML/CFT/CPF (English)GABAC · Primary regional regulation
- CEMAC Regulation No. 04/24 - targeted financial sanctionsGABAC · Primary regional regulation
- Central African Republic mutual evaluationGABAC · Authoritative country assessment
- Central African Republic country assessment pageFATF · Authoritative country status
- FATF black and grey listsFATF · Authoritative current status
- GABAC implementation workshop in Bangui, July 2025GABAC · Authoritative implementation notice
- COBAC regulationsBEAC · Official banking supervisor materials
- CEMAC payment-system regulationsBEAC · Official central-bank materials
- Law No. 24.001 on personal-data protection - legal-text reproductionMaathis · Secondary legal database
- United Nations Security Council consolidated sanctions listUnited Nations · Authoritative sanctions list
Direct answers
Central African Republic KYC, KYB and AML questions
Who receives suspicious transaction reports?+
The Agence Nationale d'Investigation Financière (ANIF) of the Central African Republic.
When is an STR filed?+
Forthwith when the reporting entity knows, suspects or has good reason to suspect covered criminal proceeds or ML/TF/PF, including attempts. Telephone or electronic reports require written confirmation within 48 hours.
Is there an objective cash report?+
Yes. Article 18 covers cash transactions of CFA 5,000,000 or more, single or apparently linked, subject to its stated exceptions and continued enhanced scrutiny.
How is beneficial ownership determined?+
CDD follows ultimate controlling interest, control by other means and principal-manager fallback under Article 33. Register disclosure has a separate more-than-25% fallback under Article 77.
How long are financial-institution AML records retained?+
At least 10 years for customer records after closure or relationship end and for transaction records after the transaction under Article 39.
Is the Central African Republic on a FATF public list?+
It was not named on the FATF high-risk or increased-monitoring lists current at 19 June 2026. The 2023 GABAC evaluation nevertheless documents serious weaknesses requiring risk-sensitive controls.
Does personal-data law apply?+
Law No. 24.001 establishes a national personal-data framework. Confirm current implementing instruments and authority procedures before configuring registrations, transfers or breach workflows.
Can a payment product launch without approval?+
No. Classify the product under current CEMAC, COBAC, BEAC and national rules and obtain every required approval before launch.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General regulatory information, not legal advice or a licence determination. Reviewed as applicable on 16 August 2026. Confirm reporting-entity status, sector rules, ANIF filing specifications, the operational beneficial-owner register, national sanctions machinery, data-protection implementation and product licensing with the competent authority and qualified Central African counsel before launch.