Nepal KYC, KYB & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Nepal.
- Last reviewed
- Last reviewed:
- Version
- Version 1.1
Portable implementation guide
Get the PDF checklist
11 control areas · 38 implementation checks
Last reviewed: 12 November 2026 · Version 1.1
Download the checklistDirect answer
What does the Nepal compliance checklist cover?
The Nepal checklist translates primary KYC, KYB and AML rules into 11 control areas and 38 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- Primary AML law
- Assets (Money Laundering Prevention) Act, 2008, as amended
- FIU
- Financial Intelligence Unit - Nepal (FIU-Nepal)
- Suspicious reporting
- Immediately after reasonable grounds are established
- Threshold reports
- Sector-specific current threshold; generally within 15 days
- Records
- At least 5 years under applicable AML/CFT directives
- Reporting channel
- FIU-Nepal goAML
- Virtual assets
- Private virtual-asset activities remain prohibited
- FATF status
- Increased monitoring at 30 October 2026
Implementation detail
Nepal compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities, and licensingClassify the service, reporting-entity category and supervisor before launch.3 items+
Determine whether each activity is a reporting-entity activity.
- Implementation action
- Map banking, remittance, foreign exchange, payments, securities, insurance, cooperatives, casinos, real estate, precious-metals, professional, trust/company-service and other designated activities to the current perimeter.
- Evidence to retain
- Perimeter memo, service map and dated legal sources.
- Primary citation
- ALPA, 2008, as amended; FIU-Nepal reporting-entity list
Obtain every required licence, registration or approval.
- Implementation action
- Confirm the applicable Nepal Rastra Bank, sector regulator, Office of Company Registrar or other authority route before offering a regulated service.
- Evidence to retain
- Licence matrix, approvals, conditions and renewal calendar.
- Primary citation
- Applicable sector law; Payment and Settlement Act, 2019
Maintain the correct FIU and supervisory contacts.
- Implementation action
- Register and maintain goAML access and current escalation contacts for each regulated activity.
- Evidence to retain
- Portal registration, user review and authority directory.
- Primary citation
- FIU-Nepal official reporting guidance
02Governance and risk assessmentThe programme must be risk-based, governed and independently tested.3 items+
Assess institutional ML/TF/PF risk.
- Implementation action
- Assess customer, geography, product, service, channel, delivery, transaction and technology risk and refresh after material change.
- Evidence to retain
- Methodology, assessment, board approval and remediation log.
- Primary citation
- ALPA, 2008, as amended; applicable AML/CFT directive
Maintain an AML/CFT/CPF programme.
- Implementation action
- Document policies, internal controls, a qualified compliance function, employee screening, training, escalation and independent review proportionate to risk.
- Evidence to retain
- Programme, appointments, training and audit reports.
- Primary citation
- ALPA, 2008, as amended; 2081 Rules; sector directives
Apply group and agent controls where applicable.
- Implementation action
- Extend lawful information sharing, oversight and consistent preventive controls to branches, subsidiaries, agents and outsourced providers.
- Evidence to retain
- Group standard, agent register, contracts and testing.
- Primary citation
- Applicable regulator AML/CFT directive
03Natural-person identificationCDD applies at relationship opening and other statutory or regulatory triggers.4 items+
Identify and verify the customer.
- Implementation action
- Obtain required identity particulars and verify them using reliable independent documents, data or information before establishing the relationship or completing a triggered transaction.
- Evidence to retain
- Identity record, verification result and provenance.
- Primary citation
- ALPA, 2008, as amended, customer-identification provisions
Apply CDD at every applicable trigger.
- Implementation action
- Apply the current regulator threshold for occasional transactions and apply CDD regardless of amount for suspicion, wire transfers, high-risk or PEP relationships, or doubt about prior data.
- Evidence to retain
- Dated trigger table, decision log and CDD file.
- Primary citation
- ALPA, 2008, as amended; FIU-Nepal Information Booklet 2026
Understand purpose and monitor continuously.
- Implementation action
- Record the relationship purpose and expected activity, scrutinize transactions and keep customer information current on a risk-sensitive schedule.
- Evidence to retain
- Customer profile, risk decision, alerts and refresh history.
- Primary citation
- ALPA, 2008, as amended; sector directives
Control incomplete or failed CDD.
- Implementation action
- Do not open or execute where mandatory identification cannot be completed; assess termination and an STR/SAR under the applicable directive.
- Evidence to retain
- Failure record, disposition and reporting assessment.
- Primary citation
- Applicable AML/CFT directive; FIU-Nepal STR/SAR Guidelines 2025
04KYB, representatives, and beneficial ownershipVerify legal existence, authority, ownership and actual control.4 items+
Verify legal persons and arrangements.
- Implementation action
- Obtain current registration, constitutional, tax, address, business, director, management and ownership/control evidence from reliable sources.
- Evidence to retain
- OCR extract, documents and independent validation.
- Primary citation
- Companies Act, 2063 BS, as amended; ALPA CDD provisions
Identify and verify beneficial owners.
- Implementation action
- Apply the ownership, voting, other-control and senior-management fallback tests in the current sector directive; do not use one percentage across every sector without confirming the controlling rule.
- Evidence to retain
- Ownership chart, control analysis and verified identities.
- Primary citation
- ALPA, 2008, as amended; current regulator-specific AML/CFT directive
Verify representatives and authority.
- Implementation action
- Identify each person acting for a customer and authenticate the mandate before accepting instructions.
- Evidence to retain
- Representative KYC, mandate and authority verification.
- Primary citation
- ALPA CDD provisions; sector directive
Reconcile registry and customer information.
- Implementation action
- Compare Office of Company Registrar data with customer evidence, investigate discrepancies and avoid sole reliance on self-declaration.
- Evidence to retain
- Registry result, discrepancy log and resolution.
- Primary citation
- Companies Act, 2063 BS; OCR public services
05PEPs, EDD, and remote onboardingHigher-risk relationships need enhanced, documented controls.3 items+
Identify PEPs, family members and close associates.
- Implementation action
- Screen customers, beneficial owners and controllers and apply current approval, source-of-wealth, source-of-funds and enhanced-monitoring measures.
- Evidence to retain
- Screening, classification, approval and corroboration.
- Primary citation
- ALPA, 2008, as amended; current sector directive
Apply enhanced due diligence to higher risk.
- Implementation action
- Collect additional identity, ownership, purpose, source and transaction evidence and increase monitoring for higher-risk customers, products and jurisdictions.
- Evidence to retain
- EDD checklist, approval and monitoring plan.
- Primary citation
- ALPA and regulator risk-based directives
Control non-face-to-face onboarding.
- Implementation action
- Use approved methods, liveness or equivalent anti-impersonation controls, device/session evidence, fraud checks and post-onboarding monitoring under the applicable directive.
- Evidence to retain
- Method assessment, session record and control tests.
- Primary citation
- Current regulator-specific AML/CFT and digital-onboarding requirements
06Monitoring and suspicious reportingDetection and filing must preserve the statutory clock and confidentiality.4 items+
Monitor complex, unusual and economically unexplained activity.
- Implementation action
- Investigate source, destination, purpose, parties, expected activity and linked transactions and document the outcome.
- Evidence to retain
- Alerts, analysis, supporting material and decision.
- Primary citation
- ALPA, 2008, as amended; FIU-Nepal STR/SAR Guidelines 2025
Report suspicious transactions to FIU-Nepal.
- Implementation action
- File through goAML immediately after examination establishes reasonable grounds to suspect the transaction or property is connected with money laundering, terrorist financing or another covered offence.
- Evidence to retain
- Trigger timestamp, examination, STR, acknowledgement and chronology.
- Primary citation
- ALPA section 7S; FIU-Nepal STR/SAR Guidelines 2025
Report attempted suspicious activity.
- Implementation action
- Submit an SAR/STR for covered attempted transactions or suspicious activity even if no transaction completed.
- Evidence to retain
- Attempt record, analysis, filing and receipt.
- Primary citation
- ALPA section 7S(2); FIU-Nepal STR/SAR Guidelines 2025
Prevent tipping off and protect reports.
- Implementation action
- Restrict access and communications concerning STRs/SARs, related analysis and authority requests.
- Evidence to retain
- Access logs, confidentiality controls and training.
- Primary citation
- ALPA confidentiality provisions; FIU-Nepal guidance
07Thresholds, wires, payments, and virtual assetsUse current sector notices and keep licensing distinct from AML controls.5 items+
Configure current threshold reporting by sector.
- Implementation action
- Use the current Nepal Gazette/NRB threshold and FIU-Nepal sector table, aggregate linked transactions as required and file the TTR generally within fifteen days.
- Evidence to retain
- Dated threshold table, rules, tests, filings and receipts.
- Primary citation
- ALPA sections 10A and 10B; FIU-Nepal TTR Guidelines 2025; Gazette notice 2082/09/24
Detect structuring and evasion.
- Implementation action
- Identify linked or split transactions intended to avoid identification, cash limits or reporting and apply CDD and suspicious-reporting controls.
- Evidence to retain
- Aggregation logic, alerts and case decisions.
- Primary citation
- FIU-Nepal STR/SAR and TTR Guidelines 2025
Carry and screen required wire information.
- Implementation action
- Apply current originator, beneficiary, intermediary, missing-data, screening and record requirements for the institution's role.
- Evidence to retain
- Field matrix, samples, screening and repair queue.
- Primary citation
- ALPA and current sector AML/CFT directive
Obtain payment-system authorization before launch.
- Implementation action
- Classify the service and obtain the relevant NRB payment service provider or payment system operator licence/approval before operation.
- Evidence to retain
- Product memo, NRB decision and licence conditions.
- Primary citation
- Payment and Settlement Act, 2019; NRB Payment Systems Department rules
Do not facilitate prohibited private virtual-asset activity.
- Implementation action
- Block product features and transactions that would issue, exchange, trade, transfer or otherwise facilitate prohibited cryptocurrency or similar private virtual assets in Nepal; escalate indicators for investigation and reporting.
- Evidence to retain
- Product restriction, screening rules, alerts and decisions.
- Primary citation
- NRB official virtual-asset notices; FIU-Nepal Strategic Analysis Report 2025 on Virtual Assets
08Targeted financial sanctions and CPFUse current UN and Nepal lists and execute operative measures without delay.3 items+
Screen current sanctions designations.
- Implementation action
- Screen customers, beneficial owners, representatives and transactions at onboarding, on list updates and throughout the relationship.
- Evidence to retain
- List version, screening logs and match decisions.
- Primary citation
- 2081 Rules as amended; FIU-Nepal sanctions links
Freeze and report when the operative measure applies.
- Implementation action
- Prevent dealing, preserve affected property and report through the current Ministry of Home Affairs/FIU/regulator route without delay.
- Evidence to retain
- Designation, freeze timestamp, asset inventory and report.
- Primary citation
- Targeted Financial Sanctions Implementation Procedure, first amendment May 2025
Control access, delisting and unfreezing.
- Implementation action
- Permit access, release or unfreeze only on documented competent-authority authority and preserve conditions and third-party rights analysis.
- Evidence to retain
- Authority decision, conditions and release record.
- Primary citation
- 2082 amendment to 2081 Rules; MoHA TFS procedures
09Records and authority accessRecords must reconstruct the customer, decisions and transactions.3 items+
Retain AML/CFT records for the applicable period.
- Implementation action
- Apply at least five years under the applicable directive from the relevant transaction or relationship-end trigger and preserve longer where lawfully required.
- Evidence to retain
- Retention schedule, archive and retrieval test.
- Primary citation
- ALPA recordkeeping provisions; applicable sector directive
Retain reporting analysis and rationale.
- Implementation action
- Preserve STR/SAR/TTR filings, supporting documents, acknowledgements and documented non-filing decisions with integrity controls.
- Evidence to retain
- Case archive, rationale and access history.
- Primary citation
- FIU-Nepal reporting guidelines
Produce information lawfully to authorities.
- Implementation action
- Operate controlled retrieval and disclosure workflows for FIU-Nepal, regulators and authorized investigators.
- Evidence to retain
- Request log, approval, production and receipt.
- Primary citation
- ALPA FIU and supervisory powers
10Privacy, biometrics, incidents, and transfersAML processing must also respect Nepalese privacy and security rules.3 items+
Document the lawful basis and purpose for personal-data use.
- Implementation action
- Map AML duties, consent where required, purpose limitation and authorized disclosures for identity, financial, family and other personal information.
- Evidence to retain
- Data inventory, notices, legal basis and disclosure log.
- Primary citation
- Privacy Act, 2075 BS, especially sections 11-12 and lawful-disclosure provisions
Protect sensitive identity and biometric information.
- Implementation action
- Minimize collection, restrict access, secure storage/transmission and test vendors handling identity, signature, biometric or financial data.
- Evidence to retain
- Security assessment, access logs, contracts and tests.
- Primary citation
- Privacy Act, 2075 BS; Privacy Regulations, 2077 BS
Manage incidents and cross-border processing.
- Implementation action
- Maintain detection, containment, assessment, evidence and notification workflows and confirm applicable sector approval, localization or transfer safeguards before processing abroad.
- Evidence to retain
- Incident plan, transfer map, assessments and contracts.
- Primary citation
- Privacy Act and applicable NRB/sector cybersecurity requirements
11Practical evidence packsEvidence must reconstruct decisions end to end.3 items+
Maintain an onboarding evidence pack.
- Implementation action
- Bundle identity, authority, KYB, beneficial ownership, PEP, sanctions, purpose, risk and approvals.
- Evidence to retain
- Complete sample and retrieval result.
- Primary citation
- Operational control supporting ALPA CDD duties
Maintain reporting and sanctions case packs.
- Implementation action
- Link trigger, classification, decision time, filing, receipt, freeze, confidentiality and authority communications.
- Evidence to retain
- Case pack, timeline and access record.
- Primary citation
- ALPA; FIU-Nepal reporting guidance; TFS procedures
Maintain a launch and legal-change pack.
- Implementation action
- Record perimeter, licences, thresholds, reporting, sanctions, privacy, vendors, source versions and control tests.
- Evidence to retain
- Signed pack, source register and approvals.
- Primary citation
- Official sources listed below
Primary-source register
15 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- FIU-Nepal official portal and current legal resourcesNepal Rastra Bank / FIU-Nepal · Official authority index
- Assets (Money Laundering Prevention) Act, 2064 BS, amended through 2080 BSFIU-Nepal · Primary legislation - controlling Nepali text
- AML/CFT Information Booklet 2026FIU-Nepal · Official implementation overview
- Suspicious Transaction and Activity Reporting Guidelines - updated July 2025FIU-Nepal · Official reporting guidance
- Threshold Transaction Reporting Guidelines - updated July 2025FIU-Nepal · Official reporting guidance
- Money Laundering Prevention Supervision DivisionNepal Rastra Bank · Official rules, directives and supervision index
- AML/CFT Directives indexNepal Rastra Bank · Official sector directives
- Payment Systems DepartmentNepal Rastra Bank · Official payment regulator index
- Strategic Analysis Report 2025 on Virtual AssetsFIU-Nepal · Official virtual-asset risk and legal-status analysis
- Office of Company RegistrarGovernment of Nepal · Official company registry
- Companies Act, 2063 BS, as amendedOffice of Company Registrar · Primary company legislation
- Privacy Act, 2075 BSNepal Law Commission · Primary privacy legislation
- Nepal criminal-code provision protecting the national flagNepal Law Commission · Primary legislation - flag-use review
- FATF increased-monitoring statement - October 2026FATF · Authoritative current public-list status
- Nepal country and mutual-evaluation pageFATF / APG · Authoritative mutual-evaluation index
Direct answers
Nepal KYC, KYB and AML questions
Who receives suspicious and threshold reports?+
FIU-Nepal receives STRs, SARs and TTRs through its goAML reporting system.
When is a suspicious report due?+
The reporting entity must file immediately after its examination establishes reasonable grounds for suspicion under the current FIU-Nepal guideline.
What threshold applies to TTRs?+
Use the current Nepal Gazette/NRB and FIU-Nepal sector table. This checklist does not invent one universal amount across all sectors.
How should beneficial ownership be determined?+
Apply the current sector directive's ownership, voting, other-control and senior-management fallback tests and verify the relevant natural persons.
How long are AML records retained?+
Apply at least five years under the applicable directive, measured from its specified transaction or relationship-end trigger, and preserve lawful longer holds.
May a business offer cryptocurrency services in Nepal?+
No. Nepal's current official framework continues to prohibit private virtual-asset activities, including cryptocurrency-related dealing and facilitation.
Is Nepal on a FATF public list?+
Yes. Nepal remained under FATF increased monitoring on 30 October 2026 and must continue implementing its action plan.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General information, not legal advice. Reviewed 12 November 2026. Confirm the controlling Nepali text, current sector directive, Gazette thresholds, goAML specifications, sanctions procedures, licensing conditions and privacy interpretation with the competent authority and qualified Nepalese counsel.