Mauritania KYC, KYB & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Mauritania.
- Last reviewed
- Last reviewed:
- Version
- Version 1.0
Direct answer
What does the Mauritania compliance checklist cover?
The Mauritania checklist translates primary KYC, KYB and AML rules into 11 control areas and 35 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- FIU
- Mauritanian Financial Intelligence Unit
- Primary AML rule
- Law No. 2019-017 and Decree No. 2019-197, as amended in 2026
- Suspicion reporting
- Immediately, including attempted transactions
- Core AML retention
- At least 10 years after the relevant relationship or occasional transaction ends
- Targeted sanctions
- Freeze within 8 hours of publication; notify within 24 hours
- FATF status
- Not publicly listed as at 19 June 2026
Implementation detail
Mauritania compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities, and licensingResolve the reporting entity, activity and supervisor before launch.3 items+
Determine whether each activity is in AML/CFT scope.
- Implementation action
- Map every entity, product, branch, agent and profession to the financial-institution, designated non-financial business or profession, non-profit or other covered category and identify the FIU and competent supervisor.
- Evidence to retain
- Applicability memo, product map, licences and accountable-owner register.
- Primary citation
- Law 2019-017, Articles 1 and 6; Decree 2019-197, as amended
Establish the current FIU reporting route.
- Implementation action
- Designate authorised reporters, obtain the current form or secure procedure directly from the FIU, test delivery and preserve acknowledgements.
- Evidence to retain
- Appointments, reporter authority, channel test and receipt log.
- Primary citation
- Law 2019-017, Articles 15 and 29; Decree 2019-198, as amended by Decree 2026-116
Obtain authorisation before regulated activity.
- Implementation action
- Classify banking, payment, e-money, money-transfer, foreign-exchange, insurance, securities, fintech, agent and virtual-asset activities and obtain every required approval before launch.
- Evidence to retain
- Perimeter analysis, licences, conditions and renewal calendar.
- Primary citation
- Law 2019-017, Articles 1, 6 and 24-28; Central Bank official regulatory portal
02Governance and risk assessmentControls must be risk-based, documented, current and independently tested.3 items+
Maintain risk-based internal controls.
- Implementation action
- Approve policies for CDD, beneficial ownership, PEPs, sanctions, monitoring, reporting, records, training, employee screening and independent testing.
- Evidence to retain
- Policy suite, approvals, control library, training and audit reports.
- Primary citation
- Law 2019-017, Article 6; Decree 2019-197, as amended
Identify, assess and document ML/TF risks.
- Implementation action
- Assess customers, countries, products, services, transactions, channels and new technologies before use and update the assessment continuously.
- Evidence to retain
- Risk assessment, methodology, source data, change log and approvals.
- Primary citation
- Law 2019-017, Article 6(1)
Apply enhanced measures to high-risk countries and situations.
- Implementation action
- Use the entity assessment, FIU directions and current FATF statements to trigger proportionate enhanced diligence and any required countermeasures.
- Evidence to retain
- Country-risk method, list updates, EDD decisions and monitoring results.
- Primary citation
- Law 2019-017, Articles 10-11
03Natural-person identificationIdentify and verify customers, actors and beneficial owners at every applicable trigger.3 items+
Identify and verify customers using reliable evidence.
- Implementation action
- Capture identity attributes, verify reliable independent documents or data, understand purpose and intended nature and establish expected activity before or during the legally permitted onboarding sequence.
- Evidence to retain
- CDD file, source provenance, verification, purpose and risk decision.
- Primary citation
- Law 2019-017, Article 6; Decree 2019-197, as amended
Apply CDD to occasional transactions, suspicion and identity doubt.
- Implementation action
- Configure the precise relationship, occasional-transaction, wire-transfer, suspicion and identity-quality triggers in the current implementing rules; never treat a threshold as a safe harbour.
- Evidence to retain
- Trigger matrix, aggregation tests, alerts and CDD timestamps.
- Primary citation
- Decree 2019-197, as amended by Decree 2026-115
Control remote and technology-enabled onboarding.
- Implementation action
- Assess impersonation, document, liveness, device and channel risks before use; apply stronger verification where risk is elevated and preserve the decision trail.
- Evidence to retain
- Channel assessment, verification results, fraud controls and exceptions.
- Primary citation
- Law 2019-017, Articles 6 and 10
04KYB, registries, and beneficial ownershipVerify legal existence, authority, ownership and ultimate natural-person control.3 items+
Verify legal existence and authority.
- Implementation action
- Obtain current commercial-register and constitutional evidence, registered and operating addresses, directors, licences and mandates; reconcile inconsistencies.
- Evidence to retain
- Registry extract, statutes, managers, licences, mandate and discrepancy log.
- Primary citation
- Law 2019-017, beneficial-owner definition and Article 6; Decree 2019-197, as amended
Identify and verify ultimate natural-person ownership and control.
- Implementation action
- Trace every ownership layer, identify each natural person who ultimately owns or controls the customer or on whose behalf a transaction occurs, and document control exercised by other means.
- Evidence to retain
- Ownership chart, control analysis, verified identities and rationale.
- Primary citation
- Law 2019-017, Article 1 definition of beneficial owner; Decree 2019-197, as amended
Do not rely on registry data alone.
- Implementation action
- Compare customer declarations, constitutional documents and available registry information and investigate discrepancies before acceptance and during refresh.
- Evidence to retain
- Source comparison, discrepancy decisions, update log and approvals.
- Primary citation
- Law 2019-017, Articles 6 and 10
05PEPs, EDD, and relianceHigher-risk relationships require enhanced, evidenced controls.3 items+
Detect PEP exposure.
- Implementation action
- Use appropriate tools to identify whether customers or beneficial owners hold or held prominent domestic, foreign or international-organisation functions, and assess family members and close associates under current rules.
- Evidence to retain
- Screening, relationship map, match decision and refresh log.
- Primary citation
- Law 2019-017, Article 9; Decree 2019-197, as amended
Apply proportionate enhanced diligence.
- Implementation action
- Obtain required senior approval, establish source of wealth and source of funds where applicable and intensify ongoing monitoring.
- Evidence to retain
- Approval, provenance analysis and enhanced-monitoring plan.
- Primary citation
- Law 2019-017, Articles 6(2), 9 and 10
Retain responsibility when using third parties or outsourcing.
- Implementation action
- Assess legal eligibility and control access to CDD records, service levels, confidentiality, audit rights, exit and regulator access; keep the reporting entity accountable.
- Evidence to retain
- Due diligence, agreement, retrieval test and assurance results.
- Primary citation
- Law 2019-017, Articles 6 and 12; Decree 2019-197, as amended
06Monitoring and suspicious reportingFIU reporting must be immediate, complete and confidential.4 items+
Monitor and examine unusual activity.
- Implementation action
- Scrutinise activity against the customer profile and document the background and purpose of complex, important, unusual or apparently purposeless transactions.
- Evidence to retain
- Alerts, investigation, written findings and disposition.
- Primary citation
- Law 2019-017, Article 10
Report suspicion and attempts immediately.
- Implementation action
- Timestamp when suspicion or reasonable grounds arose and immediately report suspected funds, transactions and attempts to the FIU using its current route; provide requested supplements.
- Evidence to retain
- Decision chronology, report, supporting material, delivery and receipt.
- Primary citation
- Law 2019-017, Article 15
Prevent tipping off.
- Implementation action
- Restrict knowledge of reports and related action and disclose nothing to the customer or another unauthorised person.
- Evidence to retain
- Access controls, disclosure protocol, logs and training.
- Primary citation
- Law 2019-017, Article 16
Govern FIU suspension orders.
- Implementation action
- Maintain a continuously available process to implement an FIU suspension of up to five working days and a competent-authority extension of up to ten working days.
- Evidence to retain
- Escalation tree, timestamps, hold record and release authority.
- Primary citation
- Law 2019-017, Article 31
07Payments, wires, thresholds, and agentsKeep CDD triggers, special examination and authority-set reports distinct.3 items+
Do not invent a universal transaction-report threshold.
- Implementation action
- Obtain current threshold decisions and forms from the FIU, Committee or supervisor, document entity and transaction scope, aggregation, currency and filing mechanics before configuration.
- Evidence to retain
- Authoritative instrument, threshold register, tests, reports and receipts.
- Primary citation
- Law 2019-017, Article 33(14); Decree 2019-197, as amended
Preserve required wire-transfer information.
- Implementation action
- Capture required originator and beneficiary information, keep it through the payment chain and define reject, suspend, execute and follow-up rules for deficient transfers.
- Evidence to retain
- Field matrix, validation, repair queue, samples and decisions.
- Primary citation
- Law 2019-017, Article 13; Decree 2019-197, as amended
Control agents and payment intermediaries.
- Implementation action
- Confirm licensing and appointment requirements, allocate controls contractually, train and monitor agents and retain immediate access to customer and transaction evidence.
- Evidence to retain
- Approval, agent register, contracts, training, monitoring and remediation.
- Primary citation
- Law 2019-017, Articles 6 and 24-28; Central Bank official portal
08Targeted financial sanctionsScreen, freeze, restrict and report within the current national deadlines.3 items+
Screen current authoritative designations.
- Implementation action
- Screen customers, beneficial owners, controllers, representatives and relevant transactions at onboarding, on list changes and before execution.
- Evidence to retain
- List inventory, update logs, screening configuration and dispositions.
- Primary citation
- Law 2019-017, Article 14; Decrees 2019-199 and 2026-117
Freeze designated property within eight hours of publication.
- Implementation action
- Freeze without prior notice all direct or indirect owned or controlled funds and other assets within eight hours and prevent funds, services or resources being made available.
- Evidence to retain
- Freeze procedure, publication and action timestamps, asset record and blocks.
- Primary citation
- National Counter-Terrorism Committee freeze procedure, Articles 16 and 18; Decree 2026-117
Notify freezes, releases and attempted transactions.
- Implementation action
- Notify the National Counter-Terrorism Committee of the value, type, date and time within 24 hours and report measures and attempted transactions through the current procedure.
- Evidence to retain
- Notifications, receipts, directions and release decision.
- Primary citation
- National Counter-Terrorism Committee freeze procedure, Article 19; Decree 2026-117
09Records and regulator accessRecords must reconstruct customers, ownership, transactions and decisions.3 items+
Retain AML records for at least ten years.
- Implementation action
- Retain accounts, transactions, correspondence, identity copies, CDD and enhanced-diligence files and analyses for at least ten years from the end of the relationship or occasional transaction, using the applicable record-specific clock.
- Evidence to retain
- Schedule, archive sample, deletion control and legal-hold log.
- Primary citation
- Law 2019-017, Article 12(1)-(3)
Reconstruct transactions and provide records diligently.
- Implementation action
- Preserve sufficient information to reconstruct individual transactions and make controlled records available promptly to competent authorities.
- Evidence to retain
- Reconstruction test, retrieval log, request validation and disclosure receipt.
- Primary citation
- Law 2019-017, Article 12(2)
Apply extensions and holds.
- Implementation action
- Extend retention when requested by the public prosecutor for an investigation or prosecution and suspend deletion for other valid legal holds.
- Evidence to retain
- Request, hold instruction, affected records and release approval.
- Primary citation
- Law 2019-017, Article 12(4)
10Privacy, biometrics, and transfersAML processing does not displace personal-data obligations.4 items+
Map purpose, legal basis, notice, minimisation, security and retention.
- Implementation action
- Document each KYC, screening, monitoring, reporting and fraud use; limit access and fields, give applicable information and align deletion with AML holds.
- Evidence to retain
- Processing register, notices, access matrix, retention map and security tests.
- Primary citation
- Law 2017-020, Articles 5-11 and 43-47
Complete APD formalities before processing.
- Implementation action
- Determine whether declaration, authorisation or an exemption applies; obtain the required receipt or approval before implementation and repeat formalities after material change.
- Evidence to retain
- Assessment, filing, receipt or authorisation, exemption rationale and change log.
- Primary citation
- Law 2017-020, Articles 32-45; APD formalities portal
Obtain prior authorisation for biometric and specified sensitive processing.
- Implementation action
- Do not deploy biometric, national-identifier, criminal-record or file-interconnection processing until the APD authorisation analysis and required approval are complete.
- Evidence to retain
- Data inventory, impact and necessity assessment, APD application and approval.
- Primary citation
- Law 2017-020, Article 37
Control international transfers and overseas cloud services.
- Implementation action
- Apply the current APD adequate-country list and obtain prior authorisation where the destination is not listed; separately apply current overseas-cloud conditions.
- Evidence to retain
- Transfer map, destination assessment, authorisation, contract and cloud review.
- Primary citation
- Law 2017-020, Articles 21 and 73; amended APD Decisions 004/2025 and 005/2025
11Practical evidence packsKeep evidence retrievable, versioned and suitable for supervisory review.3 items+
Maintain a customer and beneficial-owner evidence pack.
- Implementation action
- Link identity and KYB evidence, ownership analysis, risk scoring, PEP and sanctions results, approvals, refreshes and exceptions to one auditable record.
- Evidence to retain
- Versioned case file with provenance, timestamps and approvals.
- Primary citation
- Law 2019-017, Articles 6, 9-12
Maintain a reporting and sanctions evidence pack.
- Implementation action
- Separate restricted FIU reports from ordinary case material while preserving decision chronology, delivery evidence, freeze actions and lawful releases.
- Evidence to retain
- Restricted reporting register, receipts, freeze log and access audit.
- Primary citation
- Law 2019-017, Articles 14-17 and 31; national freeze procedure
Schedule legal and control refreshes.
- Implementation action
- Monitor official gazettes, FIU, Central Bank, APD, FATF, MENAFATF, UN and sector authorities and retest controls after changes.
- Evidence to retain
- Regulatory inventory, alerts, review calendar, test results and remediation.
- Primary citation
- Law 2019-017, Article 6; current competent-authority publications
Primary-source register
12 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- Law No. 2019-017 on AML/CFTNational Counter-Terrorism Committee · Primary legislation
- Official legal-document collection, including Decrees 2019-197 and 2026-115 to 117Inspection Générale d'État · Official legal repository
- Targeted-financial-sanctions freeze procedureNational Counter-Terrorism Committee · Official procedure
- National Counter-Terrorism Committee powersNational Counter-Terrorism Committee · Official procedure
- Central Bank of MauritaniaCentral Bank of Mauritania · Primary regulator
- Law No. 2017-020 on personal-data protectionPersonal Data Protection Authority · Primary legislation
- Prior declaration and authorisation formalitiesPersonal Data Protection Authority · Official procedure
- Amended Decision 004/2025 on international transfersPersonal Data Protection Authority · Regulator decision
- MENAFATF mutual-evaluation preparatory visitMENAFATF · FATF-style regional body
- Jurisdictions under increased monitoring - 19 June 2026FATF · Authoritative international status
- High-risk jurisdictions subject to a call for action - 19 June 2026FATF · Authoritative international status
- United Nations Security Council consolidated listUnited Nations Security Council · Authoritative sanctions list
Direct answers
Mauritania KYC, KYB and AML questions
Who receives suspicious-transaction reports?+
The Mauritanian Financial Intelligence Unit. Obtain its current form, secure channel and acknowledgement procedure before filing.
When must suspicion be reported?+
Immediately when suspicion or reasonable grounds arise, including attempted transactions, under Article 15 of Law 2019-017.
Is there one universal threshold report?+
Do not assume one. Article 33 allows the Committee to set reports above specified amounts; confirm the current instrument, entity scope, transaction type, aggregation and route.
How is beneficial ownership identified?+
Identify the natural person who ultimately owns or controls the customer, the person on whose behalf the transaction is conducted, and any natural person exercising ultimate effective control. Confirm any operative percentage or fallback detail in current implementing rules.
How long are AML records retained?+
At least ten years under Article 12, using the applicable clock from relationship end or the occasional transaction, with longer retention when the prosecutor requires it.
What is the sanctions action time?+
The national freeze procedure requires action without prior notice within eight hours of publication and notification within 24 hours; verify the current 2026 procedure and distribution channel.
Are privacy filings required?+
Usually a prior declaration, and specified processing including biometrics, national identifiers, criminal records and file interconnection requires authorisation unless a current exemption applies.
May data be transferred abroad?+
Apply the APD's current adequate-country list. Prior authorisation is required for destinations outside that list, subject to narrow conditions in the amended transfer decision.
Is Mauritania on a FATF public list?+
Mauritania was not named in FATF's 19 June 2026 high-risk or increased-monitoring statements. This is not a low-risk determination.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General regulatory information, not legal advice or a licence determination. Reviewed as applicable on 6 September 2026. Confirm the current Financial Intelligence Unit filing route, thresholds established by competent authorities, beneficial-owner filing procedures, sanctions notices, APD formalities and product-specific permissions with the relevant authority and qualified Mauritanian counsel before launch.