Oman KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Oman.
- Dernière revue
- Dernière revue:
- Version
- Version 1.0
Guide d’implémentation portable
Obtenir la checklist PDF
11 domaines de contrôle · 38 contrôles d’implémentation
Dernière revue: 2 October 2026 · Version 1.0
Télécharger la checklistRéponse directe
Que couvre la checklist de conformité pour Oman ?
La checklist pour Oman traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 38 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- Primary AML law
- Royal Decree 30/2016
- FIU
- National Centre for Financial Information
- STR timing
- Immediately; CBO outer limit 48 hours, FSA sectors 24 hours
- CBO occasional-transaction CDD
- OMR 5,000 or more, including linked operations
- CBO occasional wire CDD
- OMR 350 or equivalent
- Financial-sector retention
- At least 10 years under applicable instructions
- Beneficial ownership
- 25% is a starting point; control still requires analysis
- FATF public lists
- Not listed at 19 June 2026
Détail d’implémentation
Exigences et actions de conformité pour Oman
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities, and licensingClassify activity and supervisor first.3 éléments+
Determine the reporting-entity category.
- Action d’implémentation
- Map services and Oman nexus to the financial-institution, DNFBP, non-profit and other covered categories.
- Preuves à conserver
- Perimeter memo, service map and authority confirmation.
- Source primaire
- Royal Decree 30/2016
Obtain every licence before regulated activity.
- Action d’implémentation
- Classify banking, payments, money services, finance, securities, insurance, fintech and virtual-asset features under current sector law.
- Preuves à conserver
- Licence matrix, approvals and conditions.
- Source primaire
- Banking Law 2/2025; National Payment Systems Law 8/2018
Use the current sector instruction and controlling Arabic text.
- Action d’implémentation
- Track BM 1187, FSA decisions and later circulars for the exact licence.
- Preuves à conserver
- Source inventory, translations and change log.
- Source primaire
- CBO AML/CFT Guidelines 2022, sections 1.1-1.3
02Governance and risk assessmentGovernance must be risk-based and demonstrably effective.3 éléments+
Maintain enterprise and customer risk assessments.
- Action d’implémentation
- Assess customers, countries, products, channels, technology, sanctions and emerging risks.
- Preuves à conserver
- Methodology, assessment, approvals and updates.
- Source primaire
- Royal Decree 30/2016; CBO Guidelines chapter 2
Maintain proportionate controls.
- Action d’implémentation
- Document CDD, monitoring, reporting, records, sanctions, training and escalation.
- Preuves à conserver
- Approved framework, procedures and issue register.
- Source primaire
- CBO BM 1187
Appoint compliance leadership and independent assurance.
- Action d’implémentation
- Preserve authority, resources, senior access and periodic testing.
- Preuves à conserver
- Appointment, board reports, audit and remediation.
- Source primaire
- Royal Decree 30/2016; CBO BM 1187
03Natural-person identificationCDD covers customers, beneficial owners and representatives.6 éléments+
Apply CDD before a relationship and at every trigger.
- Action d’implémentation
- Identify and verify relevant persons, understand purpose, and refresh for suspicion, doubt or change.
- Preuves à conserver
- Trigger analysis, identity record and timestamp.
- Source primaire
- Royal Decree 30/2016 article 33
Apply the CBO OMR 5,000 occasional-transaction threshold correctly.
- Action d’implémentation
- For a customer without a relationship, complete CDD for a single or linked operation at or above OMR 5,000; do not treat it as a universal report.
- Preuves à conserver
- Aggregation logic and samples.
- Source primaire
- BM 1187 article 6; CBO Guidelines 3.2.2 note 2
Apply the separate CBO occasional-wire threshold.
- Action d’implémentation
- Complete CDD before an occasional wire at OMR 350 or equivalent and apply wire-data controls.
- Preuves à conserver
- Transfer samples and message fields.
- Source primaire
- CBO Guidelines 3.2.2 note 3
Use reliable independent identity evidence.
- Action d’implémentation
- Validate current civil, passport, registry or other authoritative evidence.
- Preuves à conserver
- Attributes, provenance and fraud checks.
- Source primaire
- Royal Decree 30/2016 article 33
Validate representatives and authority.
- Action d’implémentation
- Verify the person and mandate before accepting instructions.
- Preuves à conserver
- Representative KYC and mandate.
- Source primaire
- CBO BM 1187 CDD provisions
Do not proceed when CDD cannot be completed.
- Action d’implémentation
- Decline or end the relationship and consider an NCFI report without tipping off.
- Preuves à conserver
- Failure, restriction and report assessment.
- Source primaire
- Royal Decree 30/2016; CBO Guidelines 3.2-3.3
04KYB and beneficial ownershipVerify legal existence, ownership and effective control.4 éléments+
Verify the legal person and understand its structure.
- Action d’implémentation
- Collect commercial registration, constitutional documents, managers and reliable registry evidence.
- Preuves à conserver
- Extract, documents and discrepancy record.
- Source primaire
- Royal Decree 30/2016 article 33
Identify natural persons who ultimately own or control.
- Action d’implémentation
- Trace direct, indirect, layered, nominee and control arrangements.
- Preuves à conserver
- Ownership chart, calculations and verified identities.
- Source primaire
- CBO Guidelines 3.2.4
Use 25% as a starting point, not a safe harbour.
- Action d’implémentation
- Identify aggregate interests of 25% or more and assess concert parties, control and lower holdings.
- Preuves à conserver
- Calculations and control rationale.
- Source primaire
- CBO Guidelines 3.2.4
Maintain current BO information and filings.
- Action d’implémentation
- Reconcile internal CDD with the commercial register and use the live MOCIIP change procedure.
- Preuves à conserver
- BO register, filings, receipts and changes.
- Source primaire
- Commercial Companies Law 18/2019; FATF/MENAFATF MER 2024
05PEPs, EDD, and remote onboardingApply enhanced measures to PEPs and higher risks.3 éléments+
Identify PEPs, family and close associates.
- Action d’implémentation
- Apply required approval, source-of-wealth, source-of-funds and enhanced monitoring under the sector rule.
- Preuves à conserver
- Screening, approval and corroboration.
- Source primaire
- Royal Decree 30/2016 article 36; CBO Guidelines 3.2.7
Apply EDD to higher-risk relationships.
- Action d’implémentation
- Obtain additional customer, purpose, wealth and funds information.
- Preuves à conserver
- Risk trigger, additional CDD and approval.
- Source primaire
- CBO Guidelines 3.2.7
Control digital onboarding.
- Action d’implémentation
- CBO licensees must use the National Digital Onboarding Registry as instructed while retaining responsibility for accuracy and EDD.
- Preuves à conserver
- Method assessment, registry result and exceptions.
- Source primaire
- CBO BM 1191
06Monitoring and suspicious reportingOngoing scrutiny supports immediate NCFI reporting.4 éléments+
Monitor and refresh on a risk basis.
- Action d’implémentation
- Compare activity with purpose, expected behaviour, risk and source of funds.
- Preuves à conserver
- Scenarios, alerts and refresh records.
- Source primaire
- CBO Guidelines 3.2.6 and 3.3
Escalate suspicion without waiting for proof.
- Action d’implémentation
- Assess transactions and attempts promptly and record grounds and formation time.
- Preuves à conserver
- Chronology, information and decision.
- Source primaire
- Royal Decree 30/2016
Notify NCFI immediately and obey the sector outer limit.
- Action d’implémentation
- File immediately; CBO-supervised entities must not exceed 48 hours and FSA capital-markets or insurance sectors must not exceed 24 hours.
- Preuves à conserver
- Suspicion timestamp, report and receipt.
- Source primaire
- CBO Guidelines 3.3.4
Prevent tipping off.
- Action d’implémentation
- Restrict report knowledge and customer communications.
- Preuves à conserver
- Access controls, training and incidents.
- Source primaire
- Royal Decree 30/2016 article 49
07Payments, wires, thresholds, and virtual assetsApply activity-specific licensing and transfer controls.3 éléments+
Carry required wire information.
- Action d’implémentation
- Transmit prescribed originator and beneficiary fields and risk-manage missing data.
- Preuves à conserver
- Field matrix, samples and repair queue.
- Source primaire
- CBO BM 1187 articles 31-40
Obtain payment or money-service approval.
- Action d’implémentation
- Map wallets, acquiring, remittance, exchange and ancillary activity to current CBO rules.
- Preuves à conserver
- Product memo, licence and safeguarding tests.
- Source primaire
- Banking Law 2/2025; BM 1192
Treat virtual-asset exposure as a distinct risk.
- Action d’implémentation
- Apply EDD to elevated exposure and confirm the current VASP registration and licensing path before launch.
- Preuves à conserver
- Feature map, perimeter analysis and approval.
- Source primaire
- CBO Circular BDD/AML/CB/2020/4480
08Targeted financial sanctionsUse current UN and Oman directions.3 éléments+
Screen designations and ownership or control.
- Action d’implémentation
- Screen relevant parties at onboarding, transactions and list updates.
- Preuves à conserver
- List versions, tests and decisions.
- Source primaire
- NCCT Decision 1/2022
Freeze without delay and notify.
- Action d’implémentation
- Prevent dealing or asset availability on a true match and notify through the live route.
- Preuves à conserver
- Match analysis, restriction time and notification.
- Source primaire
- NCCT Decision 1/2022; MER 2024
Use licences, delisting or release only under written authority.
- Action d’implémentation
- Apply designation-specific procedure and conditions.
- Preuves à conserver
- Analysis, permission and release record.
- Source primaire
- NCCT Decision 1/2022
09Records and regulator accessApply the exact sector retention rule.3 éléments+
Retain CDD and relationship records for at least ten years where CBO rules apply.
- Action d’implémentation
- Run the period from the correct relationship or transaction event and preserve longer holds.
- Preuves à conserver
- Schedule, trigger and deletion approval.
- Source primaire
- CBO BM 1187
Retain transaction and wire data for at least ten years under CBO rules.
- Action d’implémentation
- Keep enough information to reconstruct transactions and payment messages.
- Preuves à conserver
- Samples, archive and retrieval test.
- Source primaire
- CBO Guidelines 3.2.5
Produce records promptly to authorities.
- Action d’implémentation
- Preserve controlled access, legal holds and production audit trails.
- Preuves à conserver
- Access matrix, retrieval and production log.
- Source primaire
- Royal Decree 30/2016
10Privacy, biometrics, breaches, and transfersApply the 2022 law and 2024 regulation subject to scope and exemptions.3 éléments+
Map processing conditions and transparency.
- Action d’implémentation
- Inventory processing, provide notices, support rights and maintain the processing record and policy.
- Preuves à conserver
- Data map, notices, rights and record.
- Source primaire
- Royal Decree 6/2022; Decision 34/2024
Obtain the Article 5 permit when required.
- Action d’implémentation
- Before biometric, genetic, health and other listed sensitive processing, complete the MTCIT permit process unless exempt.
- Preuves à conserver
- Classification, permit and conditions.
- Source primaire
- Royal Decree 6/2022 article 5
Control processors, breaches and transfers.
- Action d’implémentation
- Appoint a DPO, contract processors, assess recipient protection and make required notifications.
- Preuves à conserver
- Appointment, contracts, assessment and incident record.
- Source primaire
- Decision 34/2024; MTCIT guidance
11Practical evidence packsEvidence must reconstruct decisions end to end.3 éléments+
Maintain an onboarding pack.
- Action d’implémentation
- Bundle identity, authority, KYB, BO, PEP, sanctions, purpose, risk, privacy and approvals.
- Preuves à conserver
- Complete sample and retrieval result.
- Source primaire
- Operational control supporting Royal Decree 30/2016
Maintain NCFI and sanctions case packs.
- Action d’implémentation
- Link activity, suspicion time, report, receipt, confidentiality, restrictions and communications.
- Preuves à conserver
- Case pack, timeline and access record.
- Source primaire
- Royal Decree 30/2016; NCCT Decision 1/2022
Maintain a launch and change pack.
- Action d’implémentation
- Record perimeter, licences, reporting, sanctions, privacy, vendors, tests and uncertainties.
- Preuves à conserver
- Signed pack, source register and approvals.
- Source primaire
- Official sources listed below
Registre des sources primaires
14 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- AML/CFT Law - Royal Decree 30/2016Central Bank of Oman · Primary legislation and official register
- CBO Instructions implementing Royal Decree 30/2016 - BM 1187Central Bank of Oman · Binding instructions
- AML/CFT Guidelines for Financial InstitutionsCentral Bank of Oman · Official guidance
- Digital Onboarding and e-KYC - BM 1191Central Bank of Oman · Official instructions
- Payment Service Providers Policy - BM 1192Central Bank of Oman · Official licensing policy
- Banking Law 2/2025 and current perimeterCentral Bank of Oman · Primary legislation and official summary
- Virtual Assets and VASPs circularCentral Bank of Oman · Official circular
- AML/CFT portal, NCCT Decision 1/2022 and sanctions guidanceCentral Bank of Oman · Official register
- Personal Data Protection Law - Royal Decree 6/2022MTCIT · Primary legislation
- Personal Data Protection Executive Regulation - Decision 34/2024MTCIT · Primary regulation
- Personal Data Protection guidance and formsMTCIT · Official guidance
- Oman Mutual Evaluation Report 2024FATF / MENAFATF · Authoritative assessment
- FATF increased monitoring - 19 June 2026FATF · Authoritative current status
- FATF call for action - 19 June 2026FATF · Authoritative current status
Réponses directes
Questions KYC, KYB et AML pour Oman
Who receives STRs?+
The National Centre for Financial Information receives reports through its current prescribed system.
When must an STR be filed?+
Immediately after suspicion arises. CBO entities must not exceed 48 hours; applicable FSA sectors use 24 hours.
What is the CBO occasional-transaction threshold?+
OMR 5,000 or more, including linked operations. It is a CDD trigger, not a universal report.
What threshold applies to an occasional wire?+
OMR 350 or equivalent under CBO rules, plus required wire information.
How is beneficial ownership determined?+
Identify aggregate interests of 25% or more, then assess control, concert parties and lower holdings; 25% is not a safe harbour.
How long are AML records kept?+
Applicable CBO rules use at least ten years. Confirm the trigger and any longer direction.
Can onboarding be digital?+
Eligible CBO licensees may use BM 1191 and the National Digital Onboarding Registry but remain responsible for accuracy and EDD.
Does biometric KYC need a permit?+
Article 5 data including biometrics requires the MTCIT permit process unless exempt.
Can payment or virtual-asset services be offered?+
Only after confirming the current activity-specific licence or registration path.
Is Oman on a FATF public list?+
No at 19 June 2026, but absence is not a low-risk conclusion.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General information, not legal advice. Reviewed 2 October 2026. Confirm controlling Arabic text, current sector instructions, NCFI filing specifications, beneficial-owner procedure, sanctions directions, privacy permits and licensing with the competent authority and qualified Oman counsel.