Cambodge KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Cambodge.
- Dernière revue
- Dernière revue:
- Version
- Version 1.1
Guide d’implémentation portable
Obtenir la checklist PDF
11 domaines de contrôle · 38 contrôles d’implémentation
Dernière revue: 11 November 2026 · Version 1.1
Télécharger la checklistRéponse directe
Que couvre la checklist de conformité pour Cambodge ?
La checklist pour Cambodge traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 38 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- Primary AML law
- Law on AML/CFT, Royal Kram NS/RKM/0620/021 (2020)
- FIU
- Cambodia Financial Intelligence Unit (CAFIU)
- Suspicious reporting
- Promptly and within 24 hours
- Beneficial owner
- 20% ownership/voting interest, other control, then senior-management fallback
- Cash reports
- CAFIU-prescribed sector threshold; aggregate connected transactions
- Records
- At least 5 years after closure or relationship end
- CAFIU hold
- Written/confirmed direction for up to 48 hours
- FATF public lists
- Not listed at 30 October 2026
Détail d’implémentation
Exigences et actions de conformité pour Cambodge
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities, and licensingClassify every activity and supervisor before launch.3 éléments+
Determine whether each service is a reporting-entity activity.
- Action d’implémentation
- Map banking, securities, insurance, microfinance, leasing, exchange, remittance, trust, real-estate, professional, casino, precious-metals and designated activities to the statutory perimeter.
- Preuves à conserver
- Perimeter memo, service map and authority register.
- Source primaire
- AML/CFT Law, Articles 4-5
Obtain required licences or registrations.
- Action d’implémentation
- Confirm NBC, SERC, CGMC, Ministry of Commerce or other competent-authority approval before providing a regulated financial, payment, gambling, e-commerce or trust service.
- Preuves à conserver
- Licence matrix, approvals and conditions.
- Source primaire
- Applicable sector laws and regulations
Use CAFIU and the correct sector supervisor.
- Action d’implémentation
- Maintain current filing, escalation and supervisory contacts for each regulated activity.
- Preuves à conserver
- Authority map, portal access and acknowledgements.
- Source primaire
- AML/CFT Law, Articles 21-23 and 29
02Governance and risk assessmentControls must be risk-based, governed and tested.3 éléments+
Assess institutional and customer ML/TF risks.
- Action d’implémentation
- Assess customer, geography, product, service, channel, transaction and technology risks and refresh after material change.
- Preuves à conserver
- Methodology, assessments, approvals and remediation.
- Source primaire
- AML/CFT Law, Article 8(1)-(3)
Maintain an AML/CFT prevention programme.
- Action d’implémentation
- Document policies, controls, senior compliance leadership, employee screening, training and independent audit proportionate to risk.
- Preuves à conserver
- Programme, appointment, training and audit reports.
- Source primaire
- AML/CFT Law, Articles 16-18
Apply group-wide controls where relevant.
- Action d’implémentation
- Extend lawful information-sharing and consistent preventive controls to branches and majority-owned subsidiaries, resolving conflicts with host-country law.
- Preuves à conserver
- Group standard, conflict analysis and testing.
- Source primaire
- AML/CFT Law, Article 8(13); CAFIU internal-controls directive
03Natural-person identificationCDD is required before relationships and defined occasional transactions.4 éléments+
Identify and verify the customer.
- Action d’implémentation
- Obtain minimum identity particulars and verify them with reliable independent documents, data or information before establishing the relationship.
- Preuves à conserver
- Identity record, verification result and provenance.
- Source primaire
- AML/CFT Law, Article 8(4)-(5)
Apply CDD for occasional transactions, suspicion and doubt.
- Action d’implémentation
- Apply the current CAFIU threshold for the relevant transaction; apply CDD regardless of amount where suspicion exists or prior data is doubtful.
- Preuves à conserver
- Threshold version, trigger log and CDD record.
- Source primaire
- AML/CFT Law, Article 8(4)
Record purpose and intended nature and monitor continuously.
- Action d’implémentation
- Build an expected-activity profile, scrutinize transactions and keep customer data current, especially for higher-risk customers.
- Preuves à conserver
- Profile, risk decision, monitoring and refresh history.
- Source primaire
- AML/CFT Law, Article 8(5)(c)-(e)
Refuse or terminate when required CDD cannot be completed.
- Action d’implémentation
- Do not open, commence or perform; terminate an existing relationship unless CAFIU directs otherwise, and consider an STR.
- Preuves à conserver
- Failure record, decision and STR assessment.
- Source primaire
- AML/CFT Law, Article 8(6)-(7)
04KYB and beneficial ownershipVerify existence, authority, ownership and actual control.4 éléments+
Verify legal persons and arrangements.
- Action d’implémentation
- Obtain registration, constitutional, tax, address, management, representation and ownership/control evidence from reliable sources.
- Preuves à conserver
- Registry extract, governing documents and validation.
- Source primaire
- AML/CFT Law, Article 8(5)(a)-(b)
Apply the beneficial-owner cascade.
- Action d’implémentation
- Identify natural persons holding directly or indirectly 20% or more of shares or voting rights, then persons controlling by other means; if none is identified, record the senior managing official fallback.
- Preuves à conserver
- Ownership chart, control analysis and verified identities.
- Source primaire
- AML/CFT Law, Articles 3(10) and 8(5)(b); CAFIU FAQ
Identify representatives and validate authority.
- Action d’implémentation
- Verify each person acting for the customer and authenticate the mandate before accepting instructions.
- Preuves à conserver
- Representative KYC, mandate and verification.
- Source primaire
- CAFIU Customer Due Diligence Directive
Reconcile registry and customer information.
- Action d’implémentation
- Compare Ministry of Commerce records and customer evidence; investigate discrepancies and do not rely solely on self-declaration.
- Preuves à conserver
- Registry result, discrepancy log and resolution.
- Source primaire
- Law on Commercial Enterprises; AML/CFT Law, Article 8
05PEPs, EDD, and remote onboardingHigher-risk relationships require enhanced controls.3 éléments+
Identify PEPs, family members and close associates.
- Action d’implémentation
- Screen customers and beneficial owners and apply the current risk-based approval, source-of-wealth/source-of-funds and monitoring measures.
- Preuves à conserver
- Screening, classification, approval and corroboration.
- Source primaire
- AML/CFT Law, Articles 3(11) and 8(5), 8(10)
Apply enhanced due diligence to higher risk.
- Action d’implémentation
- Collect additional identity, ownership, purpose, source and transaction evidence and increase monitoring for high-risk relationships and jurisdictions.
- Preuves à conserver
- EDD checklist, approval and monitoring plan.
- Source primaire
- AML/CFT Law, Article 8(10)-(14)
Control non-face-to-face onboarding.
- Action d’implémentation
- Apply enhanced measures, authentication, fraud controls and documented method testing where identification is not face to face.
- Preuves à conserver
- Method assessment, session record and tests.
- Source primaire
- AML/CFT Law, Article 10(1)(e); CAFIU CDD Directive
06Monitoring and suspicious reportingDetection, escalation and filing must preserve the statutory clock.4 éléments+
Monitor complex, unusual and economically unexplained activity.
- Action d’implémentation
- Obtain additional information on source, destination, purpose and parties and document the outcome.
- Preuves à conserver
- Alerts, analysis, supporting information and decision.
- Source primaire
- AML/CFT Law, Article 10
Report suspicious transactions and attempts to CAFIU within 24 hours.
- Action d’implémentation
- Start the clock when suspicion or reasonable grounds arise; file promptly through the prescribed current channel and preserve acknowledgement.
- Preuves à conserver
- Suspicion timestamp, STR, receipt and chronology.
- Source primaire
- AML/CFT Law, Articles 3(7), 12(2)-(4) and 13
Comply with a CAFIU transaction-hold direction.
- Action d’implémentation
- Prevent execution for the directed period, not exceeding 48 hours, and preserve the oral/written direction and release basis.
- Preuves à conserver
- Hold timestamp, direction, controls and release record.
- Source primaire
- AML/CFT Law, Article 12(5)
Prevent tipping off and protect reports.
- Action d’implémentation
- Restrict access and communications concerning STRs and related information except as CAFIU authorizes.
- Preuves à conserver
- Access logs, communication controls and training.
- Source primaire
- AML/CFT Law, Article 15
07Cash reports, wires, payments, and cryptoassetsKeep threshold reporting and product authorization distinct.5 éléments+
Configure the applicable cash-reporting threshold.
- Action d’implémentation
- Use the current CAFIU directive and sector scope; aggregate connected cash transactions and do not invent a universal amount.
- Preuves à conserver
- Dated threshold table, rules, tests and reports.
- Source primaire
- AML/CFT Law, Articles 3(8) and 12(1)
Detect structuring below thresholds.
- Action d’implémentation
- Identify linked transactions designed to avoid identification or reporting and apply CDD and suspicious-reporting controls.
- Preuves à conserver
- Aggregation logic, alerts and decisions.
- Source primaire
- AML/CFT Law, Article 9 and 12(1)
Carry and screen required wire information.
- Action d’implémentation
- Apply the CAFIU directive to originator, beneficiary, intermediary, missing-data, agent and record controls for the institution's role.
- Preuves à conserver
- Field matrix, samples, screening and repair queue.
- Source primaire
- CAFIU Directive on Remittance and Wire Transfer (2022)
Obtain payment-service authorization before launch.
- Action d’implémentation
- Classify the service under current NBC instruments and obtain the relevant licence, approval or registration before operation.
- Preuves à conserver
- Product memo, NBC decision and conditions.
- Source primaire
- NBC payment-system and payment-service instruments
Apply current cryptoasset restrictions precisely.
- Action d’implémentation
- For an NBC-supervised institution, map each activity and asset category to the 26 December 2024 Prakas and obtain required prior approval; do not imply a general VASP licence while the national framework remains under development.
- Preuves à conserver
- Classification, approval analysis and controls.
- Source primaire
- NBC Prakas on Transaction Related to Cryptoassets (2024); CAFIU 2026 updates
08Targeted financial sanctions and CPFUse current designations and documented freeze/report procedures.3 éléments+
Screen current UN and Cambodian designations.
- Action d’implémentation
- Screen customers, beneficial owners, representatives and transactions at onboarding, on list updates and throughout relationships.
- Preuves à conserver
- List version, logs and match decisions.
- Source primaire
- AML/CFT Law, Article 8(15); applicable TFS instruments
Freeze covered property without delay when legally required.
- Action d’implémentation
- Apply the operative terrorism or proliferation-financing measure, block dealing and report through the prescribed authority route.
- Preuves à conserver
- Designation, freeze timestamp, asset inventory and report.
- Source primaire
- Law on Combating Financing of Proliferation of WMD (2020); TFS sub-decrees
Control false positives, permitted access and unfreezing.
- Action d’implémentation
- Release or permit access only on documented competent-authority or court authority and preserve every condition.
- Preuves à conserver
- Authority decision, conditions and release record.
- Source primaire
- Applicable TFS and frozen-property procedures
09Records and authority accessRecords must reconstruct customers, decisions and transactions.3 éléments+
Retain customer and transaction records for at least five years.
- Action d’implémentation
- Run the period from account closure or relationship end and retain enough detail to reconstruct each transaction.
- Preuves à conserver
- Retention schedule, archive and retrieval test.
- Source primaire
- AML/CFT Law, Article 11
Retain reports, analyses and non-reporting rationale.
- Action d’implémentation
- Preserve cash and suspicious reports, supporting material and documented alert dispositions under the applicable period and lawful holds.
- Preuves à conserver
- Case archive, rationale and integrity controls.
- Source primaire
- AML/CFT Law, Articles 11-13
Produce information lawfully to CAFIU and supervisors.
- Action d’implémentation
- Operate controlled retrieval and disclosure workflows; do not invoke banking or professional secrecy to obstruct lawful AML/CFT access.
- Preuves à conserver
- Request log, production, approval and receipt.
- Source primaire
- AML/CFT Law, Articles 6, 22-23
10Privacy, biometrics, incidents, and transfersApply current sector and e-commerce duties without assuming a comprehensive privacy statute.3 éléments+
Map applicable data-protection duties by activity.
- Action d’implémentation
- Document the Electronic Commerce Law and applicable banking, telecom, consumer, cybersecurity, contractual and confidentiality duties; monitor the developing general personal-data framework.
- Preuves à conserver
- Legal map, notices, purposes and change log.
- Source primaire
- Law on Electronic Commerce (2019); applicable sector rules
Protect identity and biometric data proportionately.
- Action d’implémentation
- Minimize collection, restrict access, secure storage and transmission, test vendors and document retention/deletion without claiming a universal biometric rule.
- Preuves à conserver
- Data inventory, security assessment, access logs and vendor controls.
- Source primaire
- Electronic Commerce Law and applicable sector/confidentiality duties
Manage incidents and cross-border processing under applicable rules.
- Action d’implémentation
- Maintain detection, containment, assessment, evidence and notification workflows; confirm sector-specific requirements and safeguards before transfer.
- Preuves à conserver
- Incident plan, transfer map, assessments and contracts.
- Source primaire
- Applicable Cambodian sector and cybersecurity instruments
11Practical evidence packsEvidence must reconstruct decisions end to end.3 éléments+
Maintain an onboarding pack.
- Action d’implémentation
- Bundle identity, authority, KYB, beneficial ownership, PEP, sanctions, purpose, risk and approvals.
- Preuves à conserver
- Complete sample and retrieval result.
- Source primaire
- Operational control supporting AML/CFT Law, Article 8
Maintain reporting and sanctions case packs.
- Action d’implémentation
- Link trigger, classification, decision time, filing, receipt, hold/freeze, confidentiality and authority communications.
- Preuves à conserver
- Case pack, timeline and access record.
- Source primaire
- AML/CFT Law, Articles 12-15; CPF framework
Maintain a launch and legal-change pack.
- Action d’implémentation
- Record perimeter, licences, thresholds, reporting, sanctions, privacy, vendors, source versions and control tests.
- Preuves à conserver
- Signed pack, source register and approvals.
- Source primaire
- Official sources listed below
Registre des sources primaires
15 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- Law on Anti-Money Laundering and Combating Financing of TerrorismCAFIU · Primary legislation - official English translation
- CAFIU laws and regulations indexCAFIU · Official legal and regulatory index
- Compilation of CAFIU implementation directivesCAFIU · Official directives
- CAFIU implementation FAQCAFIU · Official implementation guidance
- Law on Combating Financing of Proliferation of WMDCAFIU · Primary legislation - official English translation
- Second National Risk Assessment 2026CAFIU · Official national risk assessment
- National Bank of Cambodia legislation indexNational Bank of Cambodia · Official regulatory index
- National Bank of Cambodia Banking CodeNational Bank of Cambodia · Official sector legal compilation
- Online Business RegistrationRoyal Government of Cambodia · Official company-registration service
- Electronic-commerce legal instrumentsKhmerSME / Royal Government of Cambodia · Official government legal resources
- SERC virtual-asset framework updateSecurities and Exchange Regulator of Cambodia · Official regulatory update
- FATF removal from increased monitoring - February 2023FATF · Authoritative public-list status
- FATF increased-monitoring statement - October 2026FATF · Authoritative current public-list status
- FATF call-for-action statement - October 2026FATF · Authoritative current public-list status
- Mutual Evaluation of CambodiaFATF / APG · Authoritative mutual evaluation index
Réponses directes
Questions KYC, KYB et AML pour Cambodge
Who receives AML reports?+
The Cambodia Financial Intelligence Unit (CAFIU).
When must suspicion be reported?+
Promptly and within 24 hours after suspicion or reasonable grounds arise.
Is there one universal cash-reporting amount?+
No amount should be assumed universally; use the current CAFIU directive and sector scope and aggregate connected transactions.
How is a beneficial owner identified?+
Apply the 20% direct or indirect ownership/voting-interest test, then control by other means, then the senior managing official fallback.
How long are AML records retained?+
At least five years after account closure or the end of the business relationship, subject to lawful longer holds.
Can CAFIU stop a transaction?+
CAFIU may direct a reporting entity not to proceed for a specified period not exceeding 48 hours under Article 12(5).
Are cryptoasset services generally licensed?+
NBC-supervised institutions must follow the 2024 Prakas and obtain required approval for covered activities; Cambodia's broader virtual-asset framework remained under development at review.
Is Cambodia on a FATF public list?+
No at 30 October 2026. Cambodia remains an APG member and public-list absence is not a low-risk determination.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General information, not legal advice. Reviewed 11 November 2026. Confirm the controlling Khmer text, current CAFIU directives, reporting portal specifications, sector thresholds, live sanctions measures, privacy duties and product licensing with the competent authority and qualified Cambodian counsel.