Paraguay KYC, KYB & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Paraguay.
- Last reviewed
- Last reviewed:
- Version
- Version 1.0
Direct answer
What does the Paraguay compliance checklist cover?
The Paraguay checklist translates primary KYC, KYB and AML rules into 11 control areas and 31 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- FIU
- SEPRELAD
- Primary framework
- Law 1015/1997 as amended, including Law 6497/2019
- Suspicion reporting
- Completed or attempted suspicious operations, regardless of amount, to SEPRELAD under the applicable sector rule
- Beneficial ownership
- Natural-person ownership or control; Law 6446 administrative registers
- Retention
- Five years after the relationship ends or occasional transaction
- FATF status
- Not named on FATF public lists reviewed 12 August 2026
Implementation detail
Paraguay compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities, and licensingResolve the exact legal entity, activity and supervisor before applying a sector rule.3 items+
Determine whether each activity is within the reporting-entity sectors in Law 1015.
- Implementation action
- Map products, customers and delivery channels to article 13 and the current SEPRELAD or natural-supervisor rule; document uncertain scope.
- Evidence to retain
- Applicability memo, product map and authority or counsel confirmation.
- Primary citation
- Law 1015 art. 13, as amended by Law 6960
Treat SEPRELAD as the FIU and national AML/CFT application authority.
- Implementation action
- Complete applicable registration, nominate authorised users and maintain tested access to the live reporting channel.
- Evidence to retain
- Registration, user approvals, access test and reporting procedure.
- Primary citation
- Law 1015 arts. 25 and 28, as amended
Obtain authorisation before regulated financial, payment, remittance, credit or virtual-asset activity.
- Implementation action
- Classify the model with BCP, SEPRELAD and any other competent supervisor and secure required licences or registrations before launch.
- Evidence to retain
- Perimeter analysis, authority correspondence and licence register.
- Primary citation
- Law 1015 art. 13; applicable sector legislation
02Governance and risk assessmentGovernance must reflect the entity's sector, products, customers, channels and geography.2 items+
Maintain written risk-based AML/CFT/CPF policies and controls.
- Implementation action
- Approve risk assessment, CDD, monitoring, reporting, sanctions, training, audit and remediation arrangements and update them for legal change.
- Evidence to retain
- Board approvals, manual, risk assessment, testing and remediation log.
- Primary citation
- Law 1015 arts. 15-16 and 21, as amended by Law 6497
Designate an empowered compliance officer when required by the applicable rule.
- Implementation action
- Verify eligibility, independence, access, resources and any registration or approval requirement for the sector.
- Evidence to retain
- Appointment, role profile, authority filing and board minutes.
- Primary citation
- Law 1015 art. 35; applicable SEPRELAD sector resolution
03Natural-person identificationCDD must use reliable independent documents, data or information.3 items+
Identify and verify the customer and understand the relationship purpose.
- Implementation action
- Collect identity, address, activity, purpose and expected activity; authenticate evidence before service where required.
- Evidence to retain
- Identity file, verification output, profile and approval.
- Primary citation
- Law 1015 art. 15, as amended by Law 6497
Identify the person acting for a customer and verify authority.
- Implementation action
- Verify the representative and customer, authenticate powers and resolve discrepancies.
- Evidence to retain
- Identity results, power, registry evidence and approval.
- Primary citation
- Law 1015 arts. 15-16
Do not start or continue when required CDD cannot be completed.
- Implementation action
- Refuse the operation or relationship, document the decision and assess a confidential ROS without tipping off.
- Evidence to retain
- Decline or exit record, investigation and ROS decision.
- Primary citation
- Law 1015 art. 15, as amended by Law 6497
04KYB, registries, and beneficial ownershipRegistry evidence supports but does not replace independent ownership and control analysis.4 items+
Verify legal existence, purpose, address, governance and authority.
- Implementation action
- Obtain current registry, constitutive, tax, director, signatory and power evidence.
- Evidence to retain
- Registry extract, constitutive documents, RUC evidence and powers.
- Primary citation
- Law 1015 arts. 15-16; Law 6446
Identify and reasonably verify the natural-person beneficial owner.
- Implementation action
- Trace every ownership and control layer and apply the Law 6446 ownership, voting, benefit, appointment and other-control conditions without collapsing them into one test.
- Evidence to retain
- Ownership chart, source records, control analysis and verified identities.
- Primary citation
- Law 1015 arts. 15-16; Law 6446
Confirm required communications to the administrative legal-person and beneficial-owner registers.
- Implementation action
- Obtain current SIARA evidence, monitor changes and annual confirmation duties, and escalate discrepancies.
- Evidence to retain
- Registry communications, receipts, refresh log and discrepancy decision.
- Primary citation
- Law 6446; current MEF/DGPEJBF rules
Use beneficial-owner information only through authorised access.
- Implementation action
- Record the legal basis for registry access and do not describe the detailed register as an unrestricted public database.
- Evidence to retain
- Access approval, query log and customer evidence.
- Primary citation
- Law 6446 arts. 8-10; Decree 3241/2020
05PEPs, EDD, and remote onboardingHigher risk requires enhanced evidence and oversight.2 items+
Detect PEPs and apply enhanced measures under the current sector rule.
- Implementation action
- Screen customers, beneficial owners and connected persons; obtain senior approval, source-of-wealth and source-of-funds evidence and enhanced monitoring where required.
- Evidence to retain
- Screening, match decision, approval, provenance and monitoring plan.
- Primary citation
- Law 1015 arts. 15-16; applicable SEPRELAD sector resolution
Control non-face-to-face onboarding risk.
- Implementation action
- Use proportionate authentication, liveness, device, fraud and exception controls and validate their effectiveness.
- Evidence to retain
- Remote-onboarding assessment, test results and exceptions.
- Primary citation
- Law 1015 arts. 15-16; applicable sector rule
06Monitoring and suspicious reportingSuspicion is independent of amount and reporting is confidential.3 items+
Monitor transactions against the customer's profile.
- Implementation action
- Detect and investigate unusual, complex, linked and attempted activity and preserve a reasoned conclusion.
- Evidence to retain
- Alerts, investigation, disposition and rule governance.
- Primary citation
- Law 1015 arts. 15, 17 and 19
Report completed or attempted suspicious operations to SEPRELAD regardless of amount.
- Implementation action
- Apply the live sector analysis and filing timetable and submit through SIRO or the prescribed channel with supporting information.
- Evidence to retain
- ROS decision, chronology, submission and acknowledgement.
- Primary citation
- Law 1015 art. 19, as amended by Law 6497; applicable sector resolution
Prevent tipping off and protect ROS confidentiality.
- Implementation action
- Restrict access, exclude ROS information from customer disclosures and train staff and providers.
- Evidence to retain
- Access logs, procedure and training.
- Primary citation
- Law 1015 arts. 19-20 and 32
07Payments, wires, thresholds, and agentsObjective reports, thresholds and deadlines are sector-specific.3 items+
Configure only the objective reports applicable to the entity's current rule.
- Implementation action
- Confirm amount, currency, aggregation, period, negative-report duty and deadline from the current resolution before configuration.
- Evidence to retain
- Rule copy, mapping, tests and receipts.
- Primary citation
- Applicable SEPRELAD sector resolution and SIRO manual
Preserve originator and beneficiary traceability for transfers.
- Implementation action
- Validate required data and apply risk-based reject, suspend or escalation rules for missing information.
- Evidence to retain
- Payment message, validation and exception decision.
- Primary citation
- Law 1015 arts. 17-18; applicable BCP/SEPRELAD rule
Retain accountability for agents and outsourced providers.
- Implementation action
- Perform diligence, contract for security and record access, monitor performance and test retrieval.
- Evidence to retain
- Due diligence, contract, monitoring and retrieval test.
- Primary citation
- Law 1015 arts. 15-18 and 21
08Targeted financial sanctionsScreening must lead to the statutory immobilisation and reporting process.3 items+
Screen applicable UN sanctions designations and national notices.
- Implementation action
- Screen customers, beneficial owners, counterparties and transactions on onboarding, list updates and before execution.
- Evidence to retain
- List source, update log, match logic and dispositions.
- Primary citation
- Law 6419 arts. 1-2
Immobilise covered funds or assets without delay and communicate immediately to SEPRELAD.
- Implementation action
- Prevent movement or availability, identify all assets and report the match, reasons and action timestamps through the prescribed route.
- Evidence to retain
- Match file, freeze timestamp, asset inventory and SEPRELAD communication.
- Primary citation
- Law 6419 art. 3
Release only under a legally sufficient authority process.
- Implementation action
- Document false-positive, exclusion or delisting analysis and authenticate the release instruction.
- Evidence to retain
- Authority decision and controlled release approval.
- Primary citation
- Law 6419
09Records and regulator accessRecords must reconstruct customers, operations, analyses and reports.3 items+
Retain operation records for five years from the operation or relationship end, as applicable.
- Implementation action
- Preserve complete transaction records in retrievable form and document the retention trigger.
- Evidence to retain
- Schedule, archive sample and deletion control.
- Primary citation
- Law 1015 art. 18, as amended by Law 6497
Retain CDD, files, correspondence and analysis for five years after relationship end or occasional transaction.
- Implementation action
- Link identity, ownership, monitoring and reporting support under stable identifiers.
- Evidence to retain
- CDD archive, case files and retrieval test.
- Primary citation
- Law 1015 art. 18, as amended by Law 6497
Respond to lawful SEPRELAD and supervisor requests.
- Implementation action
- Authenticate the request, preserve confidentiality, collect reproducibly and log production and receipt.
- Evidence to retain
- Request, legal review, production index and acknowledgement.
- Primary citation
- Law 1015 art. 22
10Privacy, biometrics, and transfersLaw 7593/2025 supplies the general data-protection framework alongside sector secrecy and AML duties.3 items+
Process personal data on a documented legal basis and for defined purposes.
- Implementation action
- Map notices, rights, minimisation, security, retention and AML disclosure bases; record the legal applicability date.
- Evidence to retain
- Data inventory, notices, legal-basis record and rights procedure.
- Primary citation
- Law 7593/2025
Apply enhanced controls to sensitive and biometric data and transfers.
- Implementation action
- Minimise collection, restrict access, perform a risk assessment and confirm current implementing requirements with the National Personal Data Protection Agency.
- Evidence to retain
- Impact assessment, access controls, transfer analysis and authority check.
- Primary citation
- Law 7593/2025
Apply the separate credit-data regime where relevant.
- Implementation action
- Map Law 6534 rights, security and retention rules and BCP supervision to credit-data processing.
- Evidence to retain
- Credit-data inventory, rights workflow and retention rule.
- Primary citation
- Law 6534/2020
11Practical evidence packsKeep concise packs that let a reviewer reproduce each decision.2 items+
Maintain a reconstructable onboarding pack.
- Implementation action
- Bundle identity, KYB, beneficial ownership, screening, risk, approvals and exceptions.
- Evidence to retain
- Complete sampled onboarding pack.
- Primary citation
- Operational control supporting Law 1015 arts. 15-18
Maintain a reconstructable monitoring and reporting pack.
- Implementation action
- Link transactions, alerts, analysis, approvals, submissions and post-filing controls while protecting confidentiality.
- Evidence to retain
- Complete sampled case pack and access log.
- Primary citation
- Operational control supporting Law 1015 arts. 19-22
Primary-source register
12 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- Consolidated Law 1015/1997 - current AML frameworkSEPRELAD · Primary legislation - consolidated
- Law 6497/2019 - principal preventive-framework amendmentsSEPRELAD · Primary legislation
- SEPRELAD frequently asked questionsSEPRELAD · Official FIU guidance
- SEPRELAD resolutions inventorySEPRELAD · Official regulatory inventory
- Law 6419 - targeted financial sanctionsCongressional legal database · Primary legislation
- Law 6446 - legal-person and beneficial-owner registersCongressional legal database · Primary legislation
- DGPEJBF registry authority and current legal inventoryMinistry of Economy and Finance · Official registry authority
- Law 7593/2025 - general personal-data protectionCongressional legal database · Primary legislation
- Law 6534 - personal credit-data protectionCongressional legal database · Primary legislation
- Banco Central del ParaguayBCP · Official financial supervisor
- FATF Paraguay mutual-evaluation pageFATF · Authoritative country assessment
- FATF black and grey listsFATF · Authoritative current status
Direct answers
Paraguay KYC, KYB and AML questions
Who receives suspicious-operation reports in Paraguay?+
SEPRELAD, through SIRO or the reporting channel prescribed for the obliged entity.
When is a ROS filed?+
Law 1015 covers completed or attempted suspicious activity regardless of amount. The analysis and filing timetable is sector-specific, so apply the current SEPRELAD resolution.
Is there one universal objective-report threshold?+
No. Report types, thresholds, aggregation periods, deadlines and negative-report duties vary by sector and current resolution.
How long are AML records retained?+
Five years, calculated from the operation, relationship end or occasional transaction as specified by article 18.
Is beneficial ownership only a registry check?+
No. Reporting entities must identify and reasonably verify natural-person ownership or control; registry evidence supports but does not replace CDD.
What happens on a sanctions match?+
A covered reporting entity must immobilise the funds or assets without delay and communicate immediately to SEPRELAD under Law 6419.
Does Paraguay have a general data-protection law?+
Yes. Law 7593/2025 establishes the general regime and national authority; confirm implementation and sector overlays for the planned processing.
Is Paraguay on a FATF public list?+
Paraguay was not named on the FATF public lists reviewed 12 August 2026. Recheck the live lists before reliance.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General regulatory information, not legal advice or a licence determination. Reviewed and legally scoped as applicable on 12 August 2026. Confirm the entity, activity, current sector resolution, SIRO filing specification, objective-report threshold, beneficial-owner access, sanctions procedure, Law 7593 implementation and product licensing with SEPRELAD, the competent supervisor and qualified Paraguayan counsel before launch.