VOVE ID Compliance Research

Malawi KYC, KYB & AML compliance checklist

Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Malawi.

Dernière revue: Dernière revue: 17 July 2026
Version: Version 1.0

Malawi KYC, KYB and AML compliance checklist cover

Réponse directe

Que couvre la checklist de conformité pour Malawi ?

La checklist pour Malawi traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 37 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.

Faits réglementaires clés

Primary AML/CFT law: Financial Crimes Act (Chapter 7:07), commenced 17 February 2017
Financial intelligence unit: Financial Intelligence Authority (FIA)
STR timing: As soon as possible and no later than three days after suspicion; attempts and any amount are covered
Large transaction reporting: MWK 5,000,000 transaction or aggregate under the 2020 Regulations; current FIA direction controls submission timing
Local mobile-money transfer reporting: Each transfer above MWK 300,000 under regulation 21
Casino CDD trigger: MWK 2,000,000 within 24 hours for specified gaming transactions, plus entry/access identification duties
Core AML retention: Seven years, with the start event determined by record class
Beneficial ownership: Natural-person ownership/control, other control, then senior-management fallback; no universal percentage stated in the Act
Data protection: Data Protection Act 2024, commenced 31 May 2024; confirm live registration and incident procedures with MACRA
FATF public lists: Not named in FATF statements dated 19 June 2026; ESAAMLG follow-up continues

Détail d’implémentation

Exigences et actions de conformité pour Malawi

Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.

01Scope, authorities and regulated activitiesResolve entity, product, profession and supervisor scope before configuring controls.3 éléments+

Financial institutions and designated non-financial businesses and professions within the statutory definition are reporting institutions.
Action d’implémentation
Map each entity, product, branch, profession, agent and outsourced activity to the Act and its supervisor.
Preuves à conserver
Perimeter memorandum, entity-product matrix, licences and authority map.
Source primaire
Financial Crimes Act (FCA), s.2 and Second Schedule
The FIA receives and analyses reports, issues guidance and supervises compliance within its mandate.
Action d’implémentation
Register required contacts and reporting access, appoint alternates and maintain a regulatory calendar.
Preuves à conserver
FIA registration, channel access, contact register and calendar.
Source primaire
FCA, ss.3-6 and 23, 33
Deposit-taking, payments, remittance, e-money and other financial services require the applicable RBM authority before launch.
Action d’implémentation
Obtain a written perimeter and every required RBM licence or approval before pilot or production operation.
Preuves à conserver
RBM classification, licence, conditions, approved product map and renewal register.
Source primaire
Financial Services Act 2010; National Payment Systems Act; RBM licensing framework

02Governance, risk assessment and control ownershipBuild accountable controls from documented customer, product, delivery, geography and transaction risk.3 éléments+

Reporting institutions identify, assess, document and keep current their ML/TF risks and apply proportionate mitigation.
Action d’implémentation
Approve enterprise and customer-risk methodologies, document inputs and overrides and review material change.
Preuves à conserver
Risk assessments, methodology, ratings, approvals and remediation plan.
Source primaire
FCA, s.21(1)-(4); 2020 Regulations, reg.3
A written customer-acceptance policy is updated annually or on new developments and approved by the board.
Action d’implémentation
Define acceptance, escalation, prohibition and exception rules and obtain annual board approval.
Preuves à conserver
Policy, board minutes, change record and staff guidance.
Source primaire
2020 Regulations, reg.18
The AML programme includes internal rules, training, compliance oversight and independent testing.
Action d’implémentation
Appoint an authorised compliance officer, provide information access and test the complete lifecycle independently.
Preuves à conserver
Appointment, charter, training, audit reports and issue tracker.
Source primaire
FCA, ss.27-28; 2020 Regulations, regs.30-35

03Natural-person identification and CDDIdentify and verify customers at relationship, prescribed transaction, wire, suspicion and identity-doubt triggers.4 éléments+

CDD is required for a relationship, prescribed occasional or wire transaction, suspicion, and doubt about earlier evidence.
Action d’implémentation
Configure all five triggers and linked-transaction detection; never let a monetary threshold suppress suspicion-driven CDD.
Preuves à conserver
Trigger matrix, aggregation logic, test cases and exceptions.
Source primaire
FCA, s.16(1); 2020 Regulations, reg.4
A natural person is identified through official documentation and verified using reliable, independent sources.
Action d’implémentation
Capture name, address, occupation and official identity evidence; validate authenticity and screen the person.
Preuves à conserver
Identity record, authenticity result, independent verification and screening decision.
Source primaire
FCA, s.16(1)-(2)(b); 2020 Regulations, regs.5-6, 10-12
Purpose, intended nature and risk-relevant source information must be understood.
Action d’implémentation
Record intended products, expected activity, counterparties, geography and corroborated source information proportionate to risk.
Preuves à conserver
Customer profile, purpose statement, expected-activity baseline and source evidence.
Source primaire
FCA, s.16(2)(a)-(b); 2020 Regulations, reg.11
Deferred verification is exceptional and allowed only where prompt completion and effective risk management are assured.
Action d’implémentation
Apply restrictions, a short completion deadline and escalation; do not treat deferral as routine onboarding.
Preuves à conserver
Exception approval, rationale, restrictions and completion timestamp.
Source primaire
FCA, s.16(7); 2020 Regulations, reg.10(2)-(3)

04KYB, authority and beneficial ownershipVerify legal existence, representatives and the natural persons who ultimately own or control the customer.4 éléments+

Legal-person CDD covers name, legal form, existence, binding powers, senior management, registered office, ownership and control.
Action d’implémentation
Obtain current CRIPC evidence and constitutive documents and reconcile directors, addresses, mandates and ownership.
Preuves à conserver
Registry extract, constitution, directors, address, licence and discrepancy log.
Source primaire
FCA, s.16(2)(c); 2020 Regulations, regs.8-9, 13-15
A person acting for another customer must have verified authority and identity.
Action d’implémentation
Verify each representative separately and validate the mandate before permitting activity.
Preuves à conserver
Identity file, mandate, board authority and verification result.
Source primaire
FCA, s.16(9)(b); 2020 Regulations, reg.16
Beneficial-owner analysis follows natural-person controlling ownership, control through other means and senior-management fallback.
Action d’implémentation
Trace every ownership layer, test non-ownership control and document why any senior-manager fallback was necessary.
Preuves à conserver
Ownership chart, registry evidence, control analysis, BO KYC and fallback rationale.
Source primaire
FCA, ss.2 and 16(3)-(4)
Trust CDD identifies the settlor, trustee, protector if any, beneficiaries or class and every other natural person exercising ultimate effective control.
Action d’implémentation
Verify the trust instrument, roles, powers, control chain and relevant natural persons.
Preuves à conserver
Trust deed, role register, powers analysis and verified identity files.
Source primaire
FCA, s.16(5)-(6); 2020 Regulations, regs.8, 13

05PEPs, enhanced due diligence and remote onboardingHigher-risk and politically exposed relationships require accountable approval and stronger evidence.4 éléments+

Systems determine whether a customer or beneficial owner is a PEP and extend reasonable measures to family and close associates.
Action d’implémentation
Screen before activation and continuously, resolve matches and preserve reliable role and relationship evidence.
Preuves à conserver
Screening, match decision, role evidence and relationship analysis.
Source primaire
FCA, ss.2 and 16(2)(d); 2020 Regulations, reg.7
PEP relationships require senior-management approval, source-of-wealth and source-of-funds measures and enhanced ongoing monitoring.
Action d’implémentation
Corroborate source evidence, record approval before starting or continuing and configure enhanced monitoring.
Preuves à conserver
Source file, approval, monitoring plan and reviews.
Source primaire
FCA, s.16(2)(d)
High risk receives enhanced CDD; simplified measures require substantiated lower risk.
Action d’implémentation
Define standard, enhanced and simplified control sets with eligibility rules and prohibited overrides.
Preuves à conserver
Risk-control matrix, rationale, approvals and override log.
Source primaire
FCA, s.21(5)-(6); 2020 Regulations, regs.3-4
Non-face-to-face relationships receive the same identification, verification and monitoring standards as face-to-face relationships; the Act's non-resident limitation must be assessed.
Action d’implémentation
Confirm legal eligibility, then use document-integrity, presence, independent-data, device and fraud checks proportionate to risk.
Preuves à conserver
Eligibility memo, remote standard, test results, fraud logs and exceptions.
Source primaire
FCA, s.16(8)

06Failed CDD, monitoring and suspicious reportingBlock unsafe activity, monitor continuously and report suspicion promptly and confidentially.5 éléments+

If satisfactory identity evidence is unavailable, do not open, start or transact; submit an STR within three days and do not proceed unless FIA directs.
Action d’implémentation
Route failed CDD to block and confidential reporting review without alerting the customer.
Preuves à conserver
Failure reason, block, STR, submission receipt and FIA direction if any.
Source primaire
FCA, s.19; 2020 Regulations, reg.4(3)-(4)
Ongoing monitoring tests activity against customer knowledge, business, risk and source information and keeps records current.
Action d’implémentation
Configure risk-based refresh, event triggers and transaction monitoring; investigate deviations.
Preuves à conserver
Refresh schedule, triggers, scenarios, alerts, cases and updated CDD.
Source primaire
FCA, s.29; 2020 Regulations, regs.19(5), 24
Suspected or confirmed transactions and attempted transactions connected to an offence are reportable regardless of amount.
Action d’implémentation
Escalate immediately, preserve the suspicion timestamp and submit a complete STR to FIA.
Preuves à conserver
Internal report, analysis, STR, receipt and case timeline.
Source primaire
FCA, s.23(1)-(2); 2020 Regulations, reg.29
An STR is due as soon as possible and no later than three days after suspicion, wherever possible before execution.
Action d’implémentation
Use a shorter internal SLA measured from the documented formation of suspicion.
Preuves à conserver
Suspicion timestamp, approval, submission timestamp and SLA monitoring.
Source primaire
FCA, s.23(1)
Tipping off and unauthorised disclosure of reports or suspicion are prohibited; reporting overrides inconsistent secrecy duties subject to legal privilege.
Action d’implémentation
Restrict case access, control customer communications and train staff on permitted disclosures.
Preuves à conserver
Access logs, communication plan, training and disclosure register.
Source primaire
FCA, ss.24-26 and 32

07Threshold reports, wires and sector triggersKeep CDD, STR and prescribed threshold-reporting duties separate.4 éléments+

Transactions or aggregate transactions of at least MWK 5,000,000 require the prescribed large-currency or electronic-transfer report, with timing guided by FIA.
Action d’implémentation
Aggregate accurately, apply current FIA formats and timing and submit an STR separately where suspicion exists.
Preuves à conserver
Threshold configuration, aggregation tests, report, FIA receipt and linked STR decision.
Source primaire
FCA, s.33; 2020 Regulations, reg.28
Local mobile-money or similar local transfer reporting applies to each transfer above MWK 300,000; domestic and international electronic transfers also fall within regulation 21.
Action d’implémentation
Confirm current FIA file specifications and configure the correct transfer populations without treating the threshold as a CDD safe harbour.
Preuves à conserver
Scope memo, transfer rules, test cases, submissions and receipts.
Source primaire
2020 Regulations, reg.21
Electronic transfers carry complete originator and beneficiary information; deficient transfers require risk-based execution, rejection or suspension and reporting controls.
Action d’implémentation
Validate required fields through the chain, hold deficient messages and monitor persistent counterpart failures.
Preuves à conserver
Field matrix, validation, repair/reject queue, monitoring and samples.
Source primaire
FCA, s.28; 2020 Regulations, reg.20
Casinos identify customers at entry or remote access and apply the MWK 2,000,000 24-hour transaction triggers specified in regulation 17.
Action d’implémentation
Aggregate chips, gaming-machine and remote-gaming activity per customer over 24 hours and retain identification records.
Preuves à conserver
Access record, aggregation, identity file and test results.
Source primaire
2020 Regulations, reg.17

08Targeted financial sanctionsImplement current UN and domestic designations without delay and without prior notice.2 éléments+

Reporting institutions screen against current domestic and United Nations designation lists and must not make funds or services available to designated persons.
Action d’implémentation
Screen customers, beneficial owners, representatives, counterparties and transactions at onboarding and on list change.
Preuves à conserver
List provenance, screening logs, population reconciliation and match decisions.
Source primaire
Financial Crimes (Suppression of Terrorist Financing and Proliferation) Regulations 2017, regs.8-12
Property of a designated person is frozen without delay and the competent authority is notified using the current procedure.
Action d’implémentation
Maintain a 24/7 escalation path, validate matches, block access without notice and contact FIA for the live reporting route.
Preuves à conserver
Match analysis, freeze timestamp, asset inventory, report and receipt.
Source primaire
2017 TFS Regulations, regs.11-12

09Records, access and assuranceRetain reconstructable evidence for the correct seven-year clock and make it promptly available.3 éléments+

Identity, transaction, correspondence, FIA reports, unreported investigations and FIA enquiries are retained for at least seven years under class-specific clocks.
Action d’implémentation
Map each record class to its statutory start event, legal hold and deletion control.
Preuves à conserver
Retention schedule, system configuration, samples, legal holds and deletion tests.
Source primaire
FCA, s.22; 2020 Regulations, reg.19
Records must reconstruct transactions and be immediately available to FIA and competent authorities.
Action d’implémentation
Index linked CDD, transaction, investigation and report evidence and test retrieval.
Preuves à conserver
Request register, retrieval tests, access control and response package.
Source primaire
FCA, s.22(3)-(5)
Reliance on a third party does not transfer ultimate CDD responsibility.
Action d’implémentation
Assess supervision and country risk, obtain core information immediately and contract for documents without delay.
Preuves à conserver
Due diligence, agreement, document tests, monitoring and exit plan.
Source primaire
FCA, s.17

10Privacy, biometrics and transfersApply the Data Protection Act 2024 alongside AML retention and disclosure duties.3 éléments+

Personal data needs a documented lawful basis, specified purpose, proportionate collection, accuracy, security and governed retention.
Action d’implémentation
Maintain a data inventory and notices, minimise onboarding fields and reconcile AML retention with privacy deletion rules.
Preuves à conserver
Inventory, lawful-basis record, notices, retention map, access and deletion logs.
Source primaire
Data Protection Act 2024
Biometric and other sensitive verification data require heightened necessity, access, security and vendor controls.
Action d’implémentation
Complete a documented privacy and security assessment before biometric processing and preserve consent or another applicable legal condition.
Preuves à conserver
Assessment, legal condition, template controls, access logs and vendor assurance.
Source primaire
Data Protection Act 2024
Security incidents and international transfers must follow the Act and current MACRA procedures.
Action d’implémentation
Confirm live notification, registration and transfer mechanics with MACRA; maintain incident and transfer playbooks without inventing deadlines not verified in the official text.
Preuves à conserver
MACRA confirmation, incident register, transfer map, contracts and assessments.
Source primaire
Data Protection Act 2024; Government Notice 40 of 2024

11Practical evidence packs and change controlMake every decision reconstructable and keep time-sensitive rules current.2 éléments+

A complete customer file links identity, KYB, ownership, screening, risk, approval, monitoring and reporting decisions.
Action d’implémentation
Block activation when mandatory evidence or approval is missing and preserve the release decision.
Preuves à conserver
Control checklist, linked case file, approvals and release log.
Source primaire
FCA, ss.16-23; 2020 Regulations
Thresholds, report channels, sanctions lists, FATF status, licensing conditions and privacy procedures require ongoing legal monitoring.
Action d’implémentation
Assign owners and review FIA, RBM, CRIPC, MACRA, Gazette, FATF and ESAAMLG sources on a governed schedule.
Preuves à conserver
Legal inventory, source log, change assessments and implementation tickets.
Source primaire
Official sources listed below

Registre des sources primaires

13 sources utilisées pour cette checklist

Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.

Réponses directes

Questions KYC, KYB et AML pour Malawi

Who receives suspicious transaction reports in Malawi?+

The Financial Intelligence Authority. Use the current FIA-prescribed form and channel.

When is an STR due?+

As soon as possible and no later than three days after suspicion is formed, wherever possible before the transaction; attempts and any amount are covered.

What is the general large-transaction reporting threshold?+

The 2020 Regulations specify MWK 5,000,000 per transaction or aggregate for prescribed large-currency and electronic-transfer reports. Confirm current FIA formats and filing timing.

Does Malawi use one beneficial-ownership percentage for AML CDD?+

No universal percentage is stated in the cited Act. Identify natural persons through controlling ownership, other control and, only when necessary, senior-management fallback.

How long are core AML records kept?+

At least seven years, with the start event depending on the record class and relationship or transaction event.

Are financial services automatically permitted after company registration?+

No. Company registration does not replace RBM or other sector licensing and approval.

How should sanctions matches be handled?+

Validate urgently, freeze designated property without delay and use the current competent-authority reporting procedure without tipping off the affected party.

Does the Data Protection Act apply to identity verification?+

Yes where personal data is processed. Document purpose and lawful basis, minimise data, secure it, govern retention and confirm sensitive-data and transfer procedures with MACRA.

Is Malawi on a FATF public list?+

Malawi was not named in FATF's public statements dated 19 June 2026. ESAAMLG follow-up is a separate peer-review process.

Méthode de recherche et de revue

VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.

This checklist is general regulatory information, not legal advice or a licence determination. It reflects sources reviewed on 17 July 2026. Confirm current Gazette amendments, FIA directives and report channels, RBM licensing conditions, CRIPC filing mechanics and MACRA data-protection procedures with Malawian counsel and the competent authority before launch. Monetary reporting thresholds, AML beneficial-ownership analysis and company-registry disclosures are distinct. VOVE ID supports evidence collection and audit trails; the reporting institution remains responsible for acceptance, reporting, freezing and compliance decisions.

Malawi KYC, KYB & AML compliance checklist

Que couvre la checklist de conformité pour Malawi ?

Faits réglementaires clés

Exigences et actions de conformité pour Malawi

Financial institutions and designated non-financial businesses and professions within the statutory definition are reporting institutions.

The FIA receives and analyses reports, issues guidance and supervises compliance within its mandate.

Deposit-taking, payments, remittance, e-money and other financial services require the applicable RBM authority before launch.

Reporting institutions identify, assess, document and keep current their ML/TF risks and apply proportionate mitigation.

A written customer-acceptance policy is updated annually or on new developments and approved by the board.

The AML programme includes internal rules, training, compliance oversight and independent testing.

CDD is required for a relationship, prescribed occasional or wire transaction, suspicion, and doubt about earlier evidence.

A natural person is identified through official documentation and verified using reliable, independent sources.

Purpose, intended nature and risk-relevant source information must be understood.

Deferred verification is exceptional and allowed only where prompt completion and effective risk management are assured.

Legal-person CDD covers name, legal form, existence, binding powers, senior management, registered office, ownership and control.

A person acting for another customer must have verified authority and identity.

Beneficial-owner analysis follows natural-person controlling ownership, control through other means and senior-management fallback.

Trust CDD identifies the settlor, trustee, protector if any, beneficiaries or class and every other natural person exercising ultimate effective control.

Systems determine whether a customer or beneficial owner is a PEP and extend reasonable measures to family and close associates.

PEP relationships require senior-management approval, source-of-wealth and source-of-funds measures and enhanced ongoing monitoring.

High risk receives enhanced CDD; simplified measures require substantiated lower risk.

Non-face-to-face relationships receive the same identification, verification and monitoring standards as face-to-face relationships; the Act's non-resident limitation must be assessed.

If satisfactory identity evidence is unavailable, do not open, start or transact; submit an STR within three days and do not proceed unless FIA directs.

Ongoing monitoring tests activity against customer knowledge, business, risk and source information and keeps records current.

Suspected or confirmed transactions and attempted transactions connected to an offence are reportable regardless of amount.

An STR is due as soon as possible and no later than three days after suspicion, wherever possible before execution.

Tipping off and unauthorised disclosure of reports or suspicion are prohibited; reporting overrides inconsistent secrecy duties subject to legal privilege.

Transactions or aggregate transactions of at least MWK 5,000,000 require the prescribed large-currency or electronic-transfer report, with timing guided by FIA.

Local mobile-money or similar local transfer reporting applies to each transfer above MWK 300,000; domestic and international electronic transfers also fall within regulation 21.

Electronic transfers carry complete originator and beneficiary information; deficient transfers require risk-based execution, rejection or suspension and reporting controls.

Casinos identify customers at entry or remote access and apply the MWK 2,000,000 24-hour transaction triggers specified in regulation 17.

Reporting institutions screen against current domestic and United Nations designation lists and must not make funds or services available to designated persons.

Property of a designated person is frozen without delay and the competent authority is notified using the current procedure.

Identity, transaction, correspondence, FIA reports, unreported investigations and FIA enquiries are retained for at least seven years under class-specific clocks.

Records must reconstruct transactions and be immediately available to FIA and competent authorities.

Reliance on a third party does not transfer ultimate CDD responsibility.

Personal data needs a documented lawful basis, specified purpose, proportionate collection, accuracy, security and governed retention.

Biometric and other sensitive verification data require heightened necessity, access, security and vendor controls.

Security incidents and international transfers must follow the Act and current MACRA procedures.

A complete customer file links identity, KYB, ownership, screening, risk, approval, monitoring and reporting decisions.

Thresholds, report channels, sanctions lists, FATF status, licensing conditions and privacy procedures require ongoing legal monitoring.

13 sources utilisées pour cette checklist

Questions KYC, KYB et AML pour Malawi

Méthode de recherche et de revue

Vérifiez une fois. Partout.

Malawi KYC, KYB & AML compliance checklist

Que couvre la checklist de conformité pour Malawi ?

Faits réglementaires clés

Exigences et actions de conformité pour Malawi

Financial institutions and designated non-financial businesses and professions within the statutory definition are reporting institutions.

The FIA receives and analyses reports, issues guidance and supervises compliance within its mandate.

Deposit-taking, payments, remittance, e-money and other financial services require the applicable RBM authority before launch.

Reporting institutions identify, assess, document and keep current their ML/TF risks and apply proportionate mitigation.

A written customer-acceptance policy is updated annually or on new developments and approved by the board.

The AML programme includes internal rules, training, compliance oversight and independent testing.

CDD is required for a relationship, prescribed occasional or wire transaction, suspicion, and doubt about earlier evidence.

A natural person is identified through official documentation and verified using reliable, independent sources.

Purpose, intended nature and risk-relevant source information must be understood.

Deferred verification is exceptional and allowed only where prompt completion and effective risk management are assured.

Legal-person CDD covers name, legal form, existence, binding powers, senior management, registered office, ownership and control.

A person acting for another customer must have verified authority and identity.

Beneficial-owner analysis follows natural-person controlling ownership, control through other means and senior-management fallback.

Trust CDD identifies the settlor, trustee, protector if any, beneficiaries or class and every other natural person exercising ultimate effective control.

Systems determine whether a customer or beneficial owner is a PEP and extend reasonable measures to family and close associates.

PEP relationships require senior-management approval, source-of-wealth and source-of-funds measures and enhanced ongoing monitoring.

High risk receives enhanced CDD; simplified measures require substantiated lower risk.

Non-face-to-face relationships receive the same identification, verification and monitoring standards as face-to-face relationships; the Act's non-resident limitation must be assessed.

If satisfactory identity evidence is unavailable, do not open, start or transact; submit an STR within three days and do not proceed unless FIA directs.

Ongoing monitoring tests activity against customer knowledge, business, risk and source information and keeps records current.

Suspected or confirmed transactions and attempted transactions connected to an offence are reportable regardless of amount.

An STR is due as soon as possible and no later than three days after suspicion, wherever possible before execution.

Tipping off and unauthorised disclosure of reports or suspicion are prohibited; reporting overrides inconsistent secrecy duties subject to legal privilege.

Transactions or aggregate transactions of at least MWK 5,000,000 require the prescribed large-currency or electronic-transfer report, with timing guided by FIA.

Local mobile-money or similar local transfer reporting applies to each transfer above MWK 300,000; domestic and international electronic transfers also fall within regulation 21.

Electronic transfers carry complete originator and beneficiary information; deficient transfers require risk-based execution, rejection or suspension and reporting controls.

Casinos identify customers at entry or remote access and apply the MWK 2,000,000 24-hour transaction triggers specified in regulation 17.

Reporting institutions screen against current domestic and United Nations designation lists and must not make funds or services available to designated persons.

Property of a designated person is frozen without delay and the competent authority is notified using the current procedure.

Identity, transaction, correspondence, FIA reports, unreported investigations and FIA enquiries are retained for at least seven years under class-specific clocks.

Records must reconstruct transactions and be immediately available to FIA and competent authorities.