Equatorial Guinea KYC, KYB & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Equatorial Guinea.
- Last reviewed
- Last reviewed:
- Version
- Version 1.0
Direct answer
What does the Equatorial Guinea compliance checklist cover?
The Equatorial Guinea checklist translates primary KYC, KYB and AML rules into 11 control areas and 32 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- FIU
- National Agency for Financial Investigation (ANIF)
- Primary AML rule
- Regulation No. 01/CEMAC/UMAC/CM of 11 April 2016
- Suspicion reporting
- Promptly to ANIF when suspicion exists; attempted transactions are covered
- Automatic cash reports
- CFAF 5 million practice reported for banks; confirm current instrument and scope
- Core retention
- 5 years after relationship end or transaction execution
- FATF status
- Not named on FATF public lists as at 19 June 2026
Implementation detail
Equatorial Guinea compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities, and licensingResolve the entity, activity and competent supervisor before launch.3 items+
Determine whether each activity is a reporting-entity activity.
- Implementation action
- Map each entity, product, channel and agent to Article 6 financial-institution and DNFBP categories and document the competent AML and sector supervisor.
- Evidence to retain
- Applicability memo, product map and supervisor register.
- Primary citation
- CEMAC Regulation No. 01/2016, Article 6
Treat ANIF as the sole national STR recipient.
- Implementation action
- Appoint an accountable correspondent and obtain the current form, secure route and acknowledgement process directly from ANIF before operations begin.
- Evidence to retain
- Appointment, ANIF instructions, channel test and access approvals.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 65-71 and 83; Decree No. 11/2007 as reformed
Obtain approval before regulated financial activity.
- Implementation action
- Classify banking, microfinance, insurance, securities, foreign-exchange, payment, electronic-money and virtual-asset activity and obtain each required approval before launch.
- Evidence to retain
- Perimeter analysis, authority correspondence and licence register.
- Primary citation
- CEMAC/COBAC/BEAC/CIMA/COSUMAF sector rules
02Governance and risk assessmentThe programme must be documented, risk-based and independently tested.3 items+
Maintain a documented ML/TF/PF risk assessment.
- Implementation action
- Assess customers, countries, products, services, transactions and channels and update the assessment when risks or operations materially change.
- Evidence to retain
- Approved methodology, assessment, controls and version history.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 13-15 and 40
Maintain written internal controls and accountable leadership.
- Implementation action
- Assign senior responsibility, confidential reporting authority, staff screening, training, testing and remediation proportionate to risk.
- Evidence to retain
- Appointments, policies, training, tests and remediation log.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 55-61
Assess new technology before deployment.
- Implementation action
- Identify and mitigate ML/TF/PF, fraud and data risks before launching new products, delivery mechanisms or technology.
- Evidence to retain
- Pre-launch assessment, approval, tests and residual-risk acceptance.
- Primary citation
- CEMAC Regulation No. 01/2016, Article 40
03Natural-person identificationCDD uses reliable independent evidence and continues throughout the relationship.3 items+
Identify and verify customers before establishing the relationship.
- Implementation action
- Verify the customer using reliable independent documents, data or information and record provenance and validity.
- Evidence to retain
- Identity file, source provenance and verification result.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 21-23
Verify representatives and their authority.
- Implementation action
- Identify the person acting for a customer, verify identity and authenticate the power to act before permitting access or execution.
- Evidence to retain
- Identity evidence, mandate, validation and access record.
- Primary citation
- CEMAC Regulation No. 01/2016, Article 29
Do not proceed where mandatory CDD fails.
- Implementation action
- Do not open, execute or continue when required CDD cannot be completed; consider an STR and prevent tipping off.
- Evidence to retain
- Decline or exit decision, investigation and restricted STR record.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 23, 32 and 83
04KYB, registries, and beneficial ownershipRegistry evidence does not replace natural-person ownership and control analysis.3 items+
Verify legal existence, governance and authority.
- Implementation action
- Obtain current one-stop-shop and RCCM evidence, constitutional documents, address, directors, signatories, tax and licence records and reconcile inconsistencies.
- Evidence to retain
- Registry extract, statutes, powers, tax record and licence file.
- Primary citation
- OHADA AUDCG and AUSCGIE; CEMAC Regulation No. 01/2016, Article 31
Identify and verify natural-person beneficial owners.
- Implementation action
- Trace ownership and control to the natural persons who ultimately own or control the customer; if no person is identified, document the senior-manager fallback and verify that person.
- Evidence to retain
- Ownership chart, source records, control analysis and verified identities.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 1, 21, 23 and 31
Do not assume a complete public beneficial-owner register exists.
- Implementation action
- Use customer, RCCM and independent records, investigate inconsistencies and document evidence gaps; obtain authority guidance before relying on any national BO facility.
- Evidence to retain
- Source comparison, discrepancy review and authority correspondence.
- Primary citation
- GABAC Mutual Evaluation 2024, Recommendation 24 findings
05PEPs, EDD, and remote onboardingHigher-risk and remote relationships require enhanced controls.3 items+
Detect PEP exposure in customers and beneficial owners.
- Implementation action
- Use risk-based systems to identify foreign and domestic PEPs, family members and close associates at onboarding and throughout the relationship.
- Evidence to retain
- Screening, relationship map, match decision and refresh log.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 25 and 60
Apply PEP approval, provenance and monitoring measures.
- Implementation action
- Obtain senior approval, establish source of wealth and source of funds and conduct enhanced ongoing monitoring.
- Evidence to retain
- Approval, provenance analysis and monitoring plan.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 25 and 60
Control remote-onboarding risk.
- Implementation action
- Use reliable identity evidence and proportionate fraud, device, liveness and exception controls; confirm current national data and electronic-process requirements.
- Evidence to retain
- Remote-onboarding assessment, vendor review, tests and exceptions.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 21-23 and 40
06Monitoring and suspicious reportingANIF reporting must be prompt, traceable and confidential.3 items+
Monitor activity against the current customer profile.
- Implementation action
- Examine complex, unusually large or apparently purposeless activity and preserve the facts, analysis and reasoned conclusion.
- Evidence to retain
- Alerts, investigation, disposition and rule governance.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 22, 35 and 43
Report suspicious transactions and attempts promptly to ANIF.
- Implementation action
- File when the statutory suspicion grounds arise, including attempted transactions, using the current ANIF form and route; preserve a decision chronology.
- Evidence to retain
- Decision log, STR, transmission proof and receipt.
- Primary citation
- CEMAC Regulation No. 01/2016, Article 83
Prevent tipping off.
- Implementation action
- Restrict access and do not disclose an STR, related information request or investigation to the customer or unauthorised persons.
- Evidence to retain
- Access logs, confidentiality procedure and training.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 87-89
07Payments, wires, thresholds, and agentsPayment controls preserve required data and distinguish verified duties from reported practice.3 items+
Confirm the current automatic cash-reporting rule before configuring it.
- Implementation action
- The 2024 evaluation records bank reports at CFAF 5 million and above; obtain the operative instrument, reporting frequency, sector scope, aggregation rule and ANIF format before production use.
- Evidence to retain
- Authority-confirmed specification, detection logic, filing and receipt.
- Primary citation
- GABAC Mutual Evaluation 2024, paragraphs 184-186
Preserve required originator and beneficiary information on wires.
- Implementation action
- Capture, validate and transmit required payer and payee data; hold, reject or investigate deficient transfers under documented risk-based procedures.
- Evidence to retain
- Message samples, validation rules, exceptions and decisions.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 36-38
Retain accountability for agents and technical partners.
- Implementation action
- Verify permissions, diligence providers, contract for security and record access, train agents, monitor performance and test retrieval.
- Evidence to retain
- Due diligence, contract, training, monitoring and retrieval test.
- Primary citation
- Regulation No. 04/18/CEMAC/UMAC/COBAC; applicable approvals
08Targeted financial sanctionsUse current lists while confirming incomplete national mechanics.3 items+
Screen applicable UN and national designations.
- Implementation action
- Screen customers, beneficial owners, controllers, representatives and transactions at onboarding, list updates and before relevant execution.
- Evidence to retain
- List inventory, update logs, screening configuration and dispositions.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 105-113; UNSC consolidated list
Freeze covered funds without prior notice.
- Implementation action
- Prevent movement or availability immediately on a confirmed designation match and escalate through the competent national process.
- Evidence to retain
- Freeze procedure, timestamps, legal basis and authority communication.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 105-106
Govern matches, reporting, false positives and release.
- Implementation action
- Obtain the current national reporting and release route, preserve confidentiality and release property only on documented lawful authority.
- Evidence to retain
- Report, receipt, match rationale, authority instruction and reconciliation.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 105-113; GABAC MER 2024, Recommendations 6-7
09Records and regulator accessRecords must reconstruct the customer, ownership, transaction and decision.3 items+
Retain CDD records for at least five years.
- Implementation action
- Retain identification and relationship records for five years after the relationship ends, subject to lawful extensions and holds.
- Evidence to retain
- Schedule, configuration, archive sample and legal-hold log.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 38-39
Retain transaction and analysis records for at least five years.
- Implementation action
- Preserve transaction records for five years after execution and retain examination results so individual transactions can be reconstructed.
- Evidence to retain
- Transaction reconstruction, analysis file and retrieval test.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 38-39
Respond securely to competent-authority requests.
- Implementation action
- Authenticate requests, protect STR confidentiality, produce reproducibly and log scope, timing and acknowledgement.
- Evidence to retain
- Request, approval, production index and receipt.
- Primary citation
- CEMAC Regulation No. 01/2016, Articles 39 and 68-71
10Privacy, biometrics, and transfersApply verified privacy and security rules without inventing an authority or deadline.3 items+
Map the lawful handling of identity and compliance data.
- Implementation action
- Document purpose, legal basis, notice, access, recipients, security and retention and reconcile national privacy rules with mandatory AML duties.
- Evidence to retain
- Data inventory, legal assessment, notices and control map.
- Primary citation
- Applicable Equatoguinean privacy, cybercrime and sector-confidentiality rules
Apply enhanced controls to biometric and sensitive data.
- Implementation action
- Document necessity, minimise collection, restrict access, encrypt data and independently test biometric security and vendor handling.
- Evidence to retain
- Impact assessment, security tests, access controls and approval.
- Primary citation
- Applicable national law and CEMAC sector security requirements
Confirm transfer and incident procedures before production.
- Implementation action
- Obtain current primary guidance on cross-border transfers, regulator competence and incident notification; do not invent a portal, adequacy test or deadline.
- Evidence to retain
- Counsel memo, authority guidance, transfer assessment and incident plan.
- Primary citation
- Current national and sector-specific data rules
11Practical evidence packsMaintain concise packs that reproduce decisions and support supervisory access.2 items+
Maintain a reconstructable onboarding pack.
- Implementation action
- Bundle identity, KYB, beneficial ownership, screening, privacy, risk, approvals and exceptions under stable identifiers.
- Evidence to retain
- Complete sampled onboarding pack.
- Primary citation
- Operational control supporting CEMAC Regulation No. 01/2016
Maintain a reconstructable monitoring and reporting pack.
- Implementation action
- Link transactions, alerts, analysis, approvals, reports and post-filing controls while protecting confidentiality.
- Evidence to retain
- Complete sampled case pack and access log.
- Primary citation
- Operational control supporting CEMAC Regulation No. 01/2016, Articles 83 and 87-89
Primary-source register
11 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- Regulation No. 01/CEMAC/UMAC/CM of 11 April 2016CEMAC / GABAC · Primary regional regulation
- Equatorial Guinea mutual evaluation 2024GABAC · Authoritative country assessment
- Equatorial Guinea mutual-evaluation publication pageFATF · Authoritative country assessment
- Equatorial Guinea country assessment pageFATF · Authoritative country status
- FATF black and grey listsFATF · Authoritative current status
- Decree reforming the National Agency for Financial InvestigationGovernment of Equatorial Guinea · Primary national decree
- Regulation No. 04/18 on payment servicesBEAC · Primary regional regulation
- BEAC payment rules and instructionsBEAC · Official regulator library
- OHADA Uniform Act on commercial companies and GIEsOHADA · Primary regional company law
- COBAC regulations libraryBEAC / COBAC · Official supervisor library
- United Nations Security Council consolidated sanctions listUnited Nations · Authoritative sanctions list
Direct answers
Equatorial Guinea KYC, KYB and AML questions
Who receives suspicious transaction reports?+
Equatorial Guinea's National Agency for Financial Investigation (ANIF), the country's sole STR recipient.
When is an STR filed?+
Promptly when statutory suspicion grounds arise; attempted transactions are covered. Obtain the current ANIF form and secure transmission route.
Is there an automatic cash-report threshold?+
The 2024 mutual evaluation records bank reporting for cash transactions of CFAF 5 million or more. Confirm the operative instrument, scope, aggregation and frequency with ANIF before configuring production rules.
How is beneficial ownership handled?+
Identify and verify the natural persons who ultimately own or control the customer. Do not assume that a complete operational public BO register is available.
How long are AML records retained?+
CDD records are retained for at least five years after the relationship ends and transaction records for at least five years after execution, subject to lawful extensions.
Is Equatorial Guinea on a FATF public list?+
It was not named on FATF's high-risk or increased-monitoring lists current at 19 June 2026. The 2024 GABAC evaluation nevertheless records major weaknesses.
Can payment or electronic-money activity launch without approval?+
No. Classify the activity under current CEMAC, COBAC and BEAC rules and obtain every required approval before launch.
Are virtual-asset services clearly licensed?+
The 2024 evaluation found no formal domestic VASP and described an evolving regional position. Obtain current COSUMAF and national authority confirmation before offering or supporting virtual-asset services.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General regulatory information, not legal advice or a licence determination. Reviewed as applicable on 23 August 2026. Confirm reporting-entity status, ANIF filing specifications, automatic-report instruments, beneficial-owner information access, targeted-sanctions procedures, current personal-data rules and product licensing with the competent authority and qualified Equatoguinean counsel before launch.