Maldives KYC, KYB & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Maldives.
- Last reviewed
- Last reviewed:
- Version
- Version 1.0
Portable implementation guide
Get the PDF checklist
11 control areas · 37 implementation checks
Last reviewed: 13 November 2026 · Version 1.0
Download the checklistDirect answer
What does the Maldives compliance checklist cover?
The Maldives checklist translates primary KYC, KYB and AML rules into 11 control areas and 37 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- Primary AML law
- Prevention of Money Laundering and Financing of Terrorism Act 10/2014
- FIU
- Financial Intelligence Unit of the Maldives, within MMA
- Suspicious reporting
- As soon as practicable; no later than 3 working days
- Cash reports
- Current MMA-prescribed threshold; linked transactions aggregate
- International transfers
- Report under section 41 and current FIU procedure
- Records
- 5 years under the statutory trigger
- Data protection
- Data Protection Bill remained in committee at review date
- FATF status
- Not on FATF public lists at 30 October 2026
Implementation detail
Maldives compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities, and licensingClassify every service and reporting-entity role before launch.3 items+
Determine whether each activity falls within the reporting-entity perimeter.
- Implementation action
- Map banking, insurance, securities, money or value transfer, foreign exchange, real estate, precious-metals, legal, accounting, trust/company-service, gaming and other designated activities to the current law and sector rules.
- Evidence to retain
- Perimeter memo, activity map and dated authority sources.
- Primary citation
- PMLFT Act 10/2014, sections 3 and 4 and definition of Reporting Entities
Obtain required licences and approvals.
- Implementation action
- Confirm the MMA, CMDA, Ministry of Economic Development and Trade or other competent-authority route before offering a regulated financial, payment, securities, insurance or business service.
- Evidence to retain
- Licence matrix, decisions, conditions and renewal calendar.
- Primary citation
- Applicable sector law; National Payment System Act 8/2021
Maintain FIU and supervisor reporting access.
- Implementation action
- Keep current filing credentials, reporting forms and escalation contacts for every regulated activity.
- Evidence to retain
- Registration evidence, access review and authority directory.
- Primary citation
- PMLFT Act, sections 27-35 and 39-41
02Governance and risk assessmentControls must be governed, risk-based and independently tested.3 items+
Assess institutional ML/TF/PF risk.
- Implementation action
- Assess customers, geographies, products, channels, transactions, technology, agents and delivery methods and refresh after material change.
- Evidence to retain
- Methodology, assessment, approval and remediation log.
- Primary citation
- PMLFT Act, sections 19 and 21; applicable sector regulation
Maintain an AML/CFT programme.
- Implementation action
- Document policies, employee screening, management-level compliance, training, escalation and internal audit proportionate to risk.
- Evidence to retain
- Programme, appointment, training and audit reports.
- Primary citation
- PMLFT Act, section 21
Control branches, agents and outsourced providers.
- Implementation action
- Apply lawful group standards, due diligence, contractual controls, monitoring and escalation to branches, agents and material vendors.
- Evidence to retain
- Group standard, agent register, contracts and testing.
- Primary citation
- PMLFT Act, section 22; applicable sector rules
03Natural-person identificationCDD applies at relationship opening and each statutory or regulatory trigger.4 items+
Identify and verify customers and principals.
- Implementation action
- Obtain required name, address, birth, national ID, work-permit or passport information and verify it using reliable independent evidence.
- Evidence to retain
- Identity record, verification result and provenance.
- Primary citation
- PMLFT Act, section 16(a)-(c)
Apply CDD at all triggers.
- Implementation action
- Apply CDD at relationship opening, the current occasional-transaction threshold, domestic or international funds transfer, suspicion, or doubt about prior identification data.
- Evidence to retain
- Dated trigger table, decision and CDD file.
- Primary citation
- PMLFT Act, section 16(a)
Understand purpose and monitor continuously.
- Implementation action
- Record purpose and intended nature, maintain a risk profile, scrutinize activity and keep information current.
- Evidence to retain
- Profile, risk decision, alerts and refresh history.
- Primary citation
- PMLFT Act, sections 16(b) and 16(h)
Control failed CDD.
- Implementation action
- Do not establish or maintain the relationship when required CDD cannot be completed and consider an FIU report.
- Evidence to retain
- Failure record, disposition and reporting assessment.
- Primary citation
- PMLFT Act, section 16(l)
04KYB, representatives, and beneficial ownershipVerify legal existence, authority, ownership and actual control.4 items+
Verify legal persons and arrangements.
- Implementation action
- Obtain current incorporation, legal form, constitutional, address, director, registration and business evidence; for trusts identify the settlor, trustees and beneficiaries.
- Evidence to retain
- Registry evidence, documents and independent checks.
- Primary citation
- PMLFT Act, sections 16(d)-(e); Companies Act 7/2023
Identify and verify beneficial owners.
- Implementation action
- Identify the natural person with controlling interest and the natural person who manages the legal person; apply any more specific current sector test.
- Evidence to retain
- Ownership chart, control analysis and verified identities.
- Primary citation
- PMLFT Act, section 16(f)
Verify persons acting for customers.
- Implementation action
- Establish whether the customer acts for another person and identify and verify that person and the mandate.
- Evidence to retain
- Representative KYC, authority and mandate checks.
- Primary citation
- PMLFT Act, section 16(g)
Reconcile registry and customer information.
- Implementation action
- Compare Business Portal and registrar data with customer evidence and resolve discrepancies without relying solely on self-declaration.
- Evidence to retain
- Registry result and discrepancy record.
- Primary citation
- Companies Act 7/2023; Ministry company-registration services
05PEPs, EDD, and remote onboardingHigher-risk and non-face-to-face relationships require enhanced controls.3 items+
Identify PEPs and apply enhanced measures.
- Implementation action
- Determine whether customers or beneficial owners are PEPs, obtain senior-management approval, establish source of wealth and funds, and strengthen ongoing monitoring.
- Evidence to retain
- Screening, classification, approval and corroboration.
- Primary citation
- PMLFT Act, section 16(j)
Apply enhanced due diligence to higher risk.
- Implementation action
- Collect additional identity, ownership, purpose, source and transaction evidence and intensify monitoring based on documented risk.
- Evidence to retain
- EDD checklist, approval and monitoring plan.
- Primary citation
- PMLFT Act, sections 16(h), 19 and applicable sector guidance
Mitigate non-face-to-face risk.
- Implementation action
- Use approved methods and additional identity, fraud, device, session and monitoring controls where the customer is not physically present.
- Evidence to retain
- Method assessment, session record and tests.
- Primary citation
- PMLFT Act, section 16(i)
06Monitoring and suspicious reportingDetection and filing must preserve the statutory clock and confidentiality.4 items+
Examine unusual activity.
- Implementation action
- Examine complex, unusual large and unusual-pattern transactions lacking apparent economic or lawful purpose and document parties and findings.
- Evidence to retain
- Alerts, analysis, supporting material and decision.
- Primary citation
- PMLFT Act, section 19
Report suspicion to the FIU.
- Implementation action
- File as soon as practicable and no later than three working days after forming suspicion or grounds to suspect proceeds of crime, money laundering or terrorist financing.
- Evidence to retain
- Trigger timestamp, analysis, report, receipt and chronology.
- Primary citation
- PMLFT Act, section 39(a)
Follow FIU instructions on suspected transactions.
- Implementation action
- Notify the FIU and follow its direction; preserve the section 42 exception and immediate-afterwards notification where delay is impossible or would frustrate beneficiary identification.
- Evidence to retain
- Notification, instruction, execution decision and timestamps.
- Primary citation
- PMLFT Act, section 42
Prevent tipping off.
- Implementation action
- Restrict access and communications about FIU information, reports and investigations.
- Evidence to retain
- Access logs, confidentiality controls and training.
- Primary citation
- PMLFT Act, section 43
07Thresholds, transfers, and paymentsUse current MMA/FIU specifications rather than assuming one universal operating threshold.4 items+
Configure cash reporting at the current prescribed threshold.
- Implementation action
- Use the current MMA amount, aggregate linked transactions and submit in the FIU-prescribed procedure and form.
- Evidence to retain
- Dated threshold table, aggregation tests, reports and receipts.
- Primary citation
- PMLFT Act, section 40
Report international funds transfers.
- Implementation action
- Detect single and apparently linked international funds transfers and report them under the current FIU procedure.
- Evidence to retain
- Detection logic, report, receipt and reconciliation.
- Primary citation
- PMLFT Act, section 41
Carry required wire-transfer information.
- Implementation action
- Capture required originator information, identify missing information, obtain repairs, and reject and report where the statutory conditions require.
- Evidence to retain
- Field matrix, samples, repair queue and decisions.
- Primary citation
- PMLFT Act, section 18
Obtain payment authorization before launch.
- Implementation action
- Classify the service and obtain every applicable MMA authorization under the current national payment-system framework.
- Evidence to retain
- Product memo, MMA decision and conditions.
- Primary citation
- National Payment System Act 8/2021; MMA payment-system materials
08Targeted financial sanctions and CPFUse current UN and Maldivian instructions and act without delay when required.3 items+
Screen current designations.
- Implementation action
- Screen customers, beneficial owners, representatives and transactions at onboarding, on list updates and throughout the relationship.
- Evidence to retain
- List version, screening logs and match decisions.
- Primary citation
- PMLFT Act, section 52; current FIU/MMA instructions
Freeze and report under operative instructions.
- Implementation action
- Immediately freeze funds or property upon the competent FIU instruction and report linked funds or property without delay.
- Evidence to retain
- Instruction, freeze timestamp, inventory and report.
- Primary citation
- PMLFT Act, section 52(c)-(e)
Control release and false positives.
- Implementation action
- Release or permit access only on documented competent-authority direction and preserve match-resolution evidence.
- Evidence to retain
- Authority decision, rationale and release record.
- Primary citation
- Current Maldivian targeted-sanctions procedures
09Records and authority accessRecords must reconstruct identities, decisions and transactions.3 items+
Retain identity and relationship records.
- Implementation action
- Retain customer, beneficial-owner, agent, account and correspondence records for at least five years after the relationship ends.
- Evidence to retain
- Retention schedule, archive and retrieval test.
- Primary citation
- PMLFT Act, section 20(a)
Retain transaction reconstruction records.
- Implementation action
- Keep sufficient transaction information for at least five years from the transaction date.
- Evidence to retain
- Transaction archive and reconstruction test.
- Primary citation
- PMLFT Act, section 20(b)
Produce information lawfully to authorities.
- Implementation action
- Operate controlled retrieval and disclosure workflows for the FIU, supervisors, investigators and law enforcement.
- Evidence to retain
- Request log, approval, production and receipt.
- Primary citation
- PMLFT Act, sections 19(b), 20 and 28
10Data governance, biometrics, incidents, and transfersApply existing confidentiality, sector and constitutional duties while the general Data Protection Bill remains pending.3 items+
Map lawful collection and disclosure.
- Implementation action
- Document AML and sector duties, customer notice, purpose, access and authorized disclosure for identity, financial and other personal information.
- Evidence to retain
- Data inventory, notice, legal basis and disclosure log.
- Primary citation
- PMLFT Act confidentiality provisions; applicable sector law
Protect identity and biometric information.
- Implementation action
- Minimize collection, restrict access, secure storage and transmission, and assess vendors handling identity, biometric or financial data.
- Evidence to retain
- Security assessment, access logs, contracts and tests.
- Primary citation
- Applicable MMA cybersecurity and confidentiality requirements
Track the pending Data Protection Bill.
- Implementation action
- Do not present the bill as enacted; monitor passage and commencement and complete a gap assessment before it takes effect.
- Evidence to retain
- Legal-change log, bill status and implementation plan.
- Primary citation
- People's Majlis, Data Protection Bill 20/2026/B-13
11Practical evidence packsEvidence must reconstruct decisions end to end.3 items+
Maintain an onboarding evidence pack.
- Implementation action
- Bundle identity, authority, KYB, beneficial ownership, PEP, sanctions, purpose, risk and approvals.
- Evidence to retain
- Complete sample and retrieval result.
- Primary citation
- Operational control supporting PMLFT Act section 16
Maintain reporting and sanctions case packs.
- Implementation action
- Link trigger, analysis, decision time, filing, receipt, FIU instruction, freeze and confidentiality evidence.
- Evidence to retain
- Case pack, timeline and access record.
- Primary citation
- PMLFT Act, sections 39-43 and 52
Maintain a launch and legal-change pack.
- Implementation action
- Record perimeter, licences, thresholds, reporting, sanctions, data governance, vendors, source versions and control tests.
- Evidence to retain
- Signed pack, source register and approvals.
- Primary citation
- Official sources listed below
Primary-source register
12 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- Prevention of Money Laundering and Financing of Terrorism Act 10/2014 - EnglishMaldives Monetary Authority · Primary legislation - official translation
- Financial Intelligence Unit official pageMaldives Monetary Authority · Official authority page
- Guidelines for Financial Institutions to Identify Suspicious ActivitiesMaldives Monetary Authority / FIU · Official FIU guidance
- Financial Intelligence Unit Annual Report 2023Maldives Monetary Authority / FIU · Official FIU report
- National Payment System Act 8/2021People's Majlis · Primary legislation
- Companies Act 7/2023 and current company regulationsMinistry of Economic Development, Transport and Trade · Primary legislation and official index
- Business PortalMinistry of Economic Development, Transport and Trade · Official company and business service
- Data Protection Bill 20/2026/B-13People's Majlis · Official bill status - not enacted at review date
- Regulation on Prevention of Money Laundering and Financing of Terrorism for Securities Related BusinessesCapital Market Development Authority · Official sector regulation index
- Maldives AML/CFT Mutual Evaluation Report 2025Asia/Pacific Group on Money Laundering · Authoritative mutual evaluation
- FATF increased-monitoring statement - October 2026FATF · Authoritative current public-list status
- FATF high-risk jurisdictions statement - October 2026FATF · Authoritative current public-list status
Direct answers
Maldives KYC, KYB and AML questions
Who receives suspicious and transaction reports?+
The Financial Intelligence Unit of the Maldives receives reports in the procedure and form it prescribes.
When is a suspicious transaction report due?+
As soon as practicable and no later than three working days after forming suspicion or grounds for suspicion under section 39(a).
What cash threshold applies?+
Use the current amount prescribed by MMA regulation and aggregate transactions that appear linked; this checklist does not invent a universal amount.
How should beneficial ownership be determined?+
Identify and reasonably verify the natural person with a controlling interest and the natural person who manages the legal person, plus any more specific current sector test.
How long are AML records retained?+
Identity and relationship records are kept at least five years after the relationship ends; transaction reconstruction records are kept at least five years from the transaction date.
Is there a general enacted data-protection law?+
The Data Protection Bill remained at committee stage on 13 November 2026; existing confidentiality, sector and constitutional duties still require implementation controls.
Is Maldives on a FATF public list?+
No. Maldives was not named in the FATF high-risk or increased-monitoring statements dated 30 October 2026.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General information, not legal advice. Reviewed 13 November 2026. Confirm the controlling Dhivehi text, amendments, current sector regulation, FIU filing specifications, sanctions instructions, licensing conditions, company-register data and privacy requirements with the competent authority and qualified Maldivian counsel.