Question 1

Who must report suspicious activity in Tunisia?

Accepted Answer

The persons and professions listed in Article 107 of the amended Organic Law No. 2015-26 must report within their professional scope. The list includes specified financial institutions and designated non-financial businesses and professions; it does not automatically cover every business operating in Tunisia.

Question 2

When must a suspicious report be filed?

Accepted Answer

Article 125 requires an immediate written report to CTAF for covered suspected operations, transactions and attempts, including where new information creates suspicion after execution. Institutions covered by BCT Circular No. 2025-17 file immediately through goAML under CTAF procedures. A general ten-day filing period is not the governing rule.

Question 3

What beneficial-owner threshold applies?

Accepted Answer

CTAF Decision No. 2018-10 uses at least 20% of capital or voting rights, followed by control through other means and then the senior-management fallback. Government Decree No. 2019-54 establishes the same ownership-or-voting threshold, other-control test and senior-manager fallback for the NRE framework. The BCT Circular No. 2017-08 definition for covered BCT institutions uses more than 20% together with ultimate ownership and effective control. Firms should document the applicable instrument and must not treat the percentage test as the only route to beneficial ownership.

Question 4

How long must AML records be retained?

Accepted Answer

Article 113 requires at least 10 years from completion of the transaction or closure of the account. Payment institutions also retain payment-operation registers for at least 10 years from execution under BCT Circular No. 2018-61. The BCT-hosted official PDF has a misleading Cir_2018_16_fr.pdf filename, but the instrument's operative number is 2018-61.

Question 5

Can customers be onboarded fully online?

Accepted Answer

The general AML law requires systems that manage non-face-to-face risk. Banks using electronic enrollment must also comply with BCT Circular No. 2025-06, including board-approved procedures, proportionate authentication, document checks, real-presence or liveness controls, screening, performance oversight and incident management. Other sectors must confirm their own supervisory rules rather than assuming the bank circular applies.

Question 6

Do KYC biometrics or foreign cloud hosting require INPDP approval?

Accepted Answer

Potentially yes. INPDP states that each processing purpose requires a declaration and that biometric processing and transfers of personal data abroad require an additional authorisation process. Complete the applicable filing before production and verify actual data locations and processor flows.

Question 7

Is Tunisia on the FATF grey list?

Accepted Answer

No. FATF removed Tunisia from monitoring in October 2019, and Tunisia is not listed among jurisdictions under increased monitoring in FATF's 19 June 2026 statement. Domestic and risk-based enhanced controls still apply where warranted.

Download the Tunisia KYC, KYB & AML checklist

Get the PDF immediately

Reviewed and source-linked

Verify once. Everywhere.

Download the Tunisia KYC, KYB & AML checklist

Get the PDF immediately

Reviewed and source-linked

Verify once. Everywhere.