Qatar KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Qatar.
- Dernière revue
- Dernière revue:
- Version
- Version 1.0
Guide d’implémentation portable
Obtenir la checklist PDF
11 domaines de contrôle · 40 contrôles d’implémentation
Dernière revue: 30 September 2026 · Version 1.0
Télécharger la checklistRéponse directe
Que couvre la checklist de conformité pour Qatar ?
La checklist pour Qatar traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 40 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- Primary framework
- Law No. 20 of 2019, as amended; Decision No. 41 of 2019
- FIU and reporting
- QFIU; ESTR for connected entities, approved manual route otherwise or for urgent cases
- STR timing
- Promptly once there are grounds to suspect; follow current QFIU and sector instructions
- CDD occasional-transaction threshold
- QAR 50,000 or more, including linked operations; lower wire-transfer rules may apply
- AML retention
- At least 10 years, with the statutory start event depending on record class
- Company BO declaration
- 20% ownership or voting control test, then effective/legal control, then legal representative fallback
- Privacy
- Law No. 13 of 2016 on Protecting Personal Data Privacy
- FATF public lists
- Not listed at 19 June 2026
Détail d’implémentation
Exigences et actions de conformité pour Qatar
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities, and licensingClassify the entity, activity and geographic regime before assigning controls.3 éléments+
Determine whether each activity is a financial institution, DNFBP or other reporting entity.
- Action d’implémentation
- Map services, customer flows and Qatar nexus to Law No. 20 of 2019, Decision No. 41 of 2019 and the sector rules for QCB, QFCRA, QFMA, MoCI or Ministry of Justice supervision.
- Preuves à conserver
- Perimeter memo, service and funds-flow maps, legal analysis and authority confirmation.
- Source primaire
- Law No. 20 of 2019, article 1; Decision No. 41 of 2019; applicable supervisory rules
Obtain the required licence or registration before regulated activity.
- Action d’implémentation
- Identify the competent authority and secure each activity-specific licence, registration or approval; record conditions and territorial limits.
- Preuves à conserver
- Licence matrix, approvals, conditions register and renewal calendar.
- Source primaire
- Law No. 13 of 2012; applicable QCB, QFCRA, QFMA and MoCI frameworks
Separate onshore and Qatar Financial Centre requirements.
- Action d’implémentation
- Apply the national law and the correct sector overlay; use QFCRA AML/CFT Rules for an authorised QFC firm and do not transpose QFC mechanics to an onshore entity.
- Preuves à conserver
- Entity-location analysis, rule mapping and documented supervisory contacts.
- Source primaire
- QFCRA Anti-Money Laundering and Combating the Financing of Terrorism Rules 2019
02Governance and ML/TF risk assessmentGovernance must be risk-based, documented and demonstrably effective.4 éléments+
Maintain an enterprise ML/TF risk assessment.
- Action d’implémentation
- Assess customers, countries, products, delivery channels, transactions, technology and emerging risks; update for material change and national or supervisory findings.
- Preuves à conserver
- Methodology, current assessment, data sources, approvals and change log.
- Source primaire
- Law No. 20 of 2019, articles 8 and 15; Decision No. 41 of 2019
Maintain proportionate policies, systems and internal controls.
- Action d’implémentation
- Document CDD, monitoring, reporting, recordkeeping, sanctions, employee screening, training, independent review and escalation controls.
- Preuves à conserver
- Approved programme, control map, procedures, training and issue register.
- Source primaire
- Law No. 20 of 2019, article 18; applicable supervisory instructions
Appoint an empowered compliance officer and deputy where required.
- Action d’implémentation
- Document independence, authority, access, competence, reporting lines and coverage; obtain or notify supervisory approval where the applicable sector rules require it.
- Preuves à conserver
- Appointment, fit-and-proper file, authority matrix, minutes and regulatory correspondence.
- Source primaire
- Law No. 20 of 2019, article 18; applicable sector rules
Independently test the AML/CFT framework.
- Action d’implémentation
- Use a suitably qualified, independent function to test design and operation at a frequency proportionate to risk and track remediation to closure.
- Preuves à conserver
- Review plan, independence assessment, report, management response and closure testing.
- Source primaire
- Law No. 20 of 2019, article 18; applicable supervisory rules
03Natural-person identificationCDD covers the customer, beneficial owner and any person acting for the customer.4 éléments+
Apply CDD when a business relationship begins or a statutory trigger arises.
- Action d’implémentation
- Identify and verify before establishment, or under a documented lawful timing exception, and apply CDD to occasional transactions of QAR 50,000 or more, linked operations, qualifying wire transfers, suspicion and doubts about prior data.
- Preuves à conserver
- Trigger analysis, identity record, verification result, relationship purpose and completion timestamp.
- Source primaire
- Law No. 20 of 2019, articles 9-12; Decision No. 41 of 2019, preventive-measures provisions
Verify identity from reliable and independent sources.
- Action d’implémentation
- Obtain official identity attributes and validate authenticity, expiry and person-to-document linkage using methods proportionate to impersonation and fraud risk.
- Preuves à conserver
- Identity attributes, source provenance, validation results, fraud checks and exception rationale.
- Source primaire
- Law No. 20 of 2019, articles 9-11; QCB AML/CFT Instructions 2020
Identify representatives and verify authority.
- Action d’implémentation
- Identify the person acting for the customer, verify identity and validate the legal mandate before accepting instructions.
- Preuves à conserver
- Representative KYC, mandate, authority checks and instruction limits.
- Source primaire
- Law No. 20 of 2019, article 10; Decision No. 41 of 2019
Do not proceed when required CDD cannot be completed.
- Action d’implémentation
- Decline or terminate the relationship or transaction as required and consider an STR without disclosing the assessment to the customer.
- Preuves à conserver
- CDD failure record, restriction or exit decision, STR assessment and communications review.
- Source primaire
- Law No. 20 of 2019, articles 11, 16 and 21
04KYB, registries, and beneficial ownershipRegistry evidence supports, but does not replace, natural-person ownership and control analysis.4 éléments+
Verify the legal person or arrangement and its powers.
- Action d’implémentation
- Collect current legal name, form, registration number, address, governing documents, directors, partners or trustees and validate them through reliable official sources.
- Preuves à conserver
- UER or commercial-register evidence, constitutional documents, officer list and discrepancy resolution.
- Source primaire
- Law No. 20 of 2019, articles 9-11; Law No. 1 of 2020
Identify the AML beneficial owner through ultimate ownership and effective control.
- Action d’implémentation
- Trace layered, nominee and legal-arrangement structures to the natural persons who ultimately own or control the customer or on whose behalf activity occurs; do not rely on a percentage alone.
- Preuves à conserver
- Ownership chart, control analysis, declarations, source documents and verified identities.
- Source primaire
- Law No. 20 of 2019, article 1 and articles 9-11
Apply the company-register declaration cascade correctly.
- Action d’implémentation
- For commercial-company UER purposes identify natural persons with at least 20% direct or indirect capital or voting control; if none, identify effective or legal controllers; if none, identify the legal representative.
- Preuves à conserver
- BO register, calculation, control analysis, fallback rationale and filing receipt.
- Source primaire
- Law No. 1 of 2020; Decision No. 12 of 2020; MoCI Beneficial Owner Guide
Maintain and update mandatory company records.
- Action d’implémentation
- Keep basic, beneficial-owner and partner or shareholder registers current; designate the required Qatar-resident information contact and file changes through the competent route.
- Preuves à conserver
- Registers, supporting documents, designation, update log and submissions.
- Source primaire
- Law No. 1 of 2020; Decision No. 12 of 2020; MoCI business-services guidance
05PEPs, EDD, and remote onboardingEnhanced measures attach to high-risk and specified circumstances.3 éléments+
Identify politically exposed persons and related persons.
- Action d’implémentation
- Screen customers and beneficial owners for domestic, foreign and international-organisation PEP status and applicable family or close-associate relationships; apply approval, source and monitoring measures required by risk and sector rules.
- Preuves à conserver
- Screening, relationship map, senior approval, source corroboration and review history.
- Source primaire
- Law No. 20 of 2019, articles 15 and 17; Decision No. 41 of 2019
Apply enhanced due diligence to higher-risk relationships.
- Action d’implémentation
- Obtain additional information on customer, ownership, purpose, source of wealth and source of funds; increase monitoring and obtain senior approval where required.
- Preuves à conserver
- Risk trigger, additional CDD, source evidence, approval and monitoring plan.
- Source primaire
- Law No. 20 of 2019, articles 13 and 15; Decision No. 41 of 2019
Control non-face-to-face and technology risk.
- Action d’implémentation
- Validate documents and liveness, prevent impersonation, test vendors, establish fallback review and apply enhanced measures where risk remains elevated.
- Preuves à conserver
- Method assessment, vendor diligence, test results, exceptions and fraud cases.
- Source primaire
- Decision No. 41 of 2019; applicable supervisory instructions
06Monitoring and suspicious transaction reportingOngoing scrutiny and prompt escalation support reporting to QFIU.4 éléments+
Keep CDD current and monitor activity continuously.
- Action d’implémentation
- Review customer and beneficial-owner information, examine transactions against purpose, profile, risk and expected source of funds, and document unusual-activity outcomes.
- Preuves à conserver
- Monitoring scenarios, alerts, case decisions, refresh records and quality testing.
- Source primaire
- Law No. 20 of 2019, article 14
Escalate suspicion without waiting for proof.
- Action d’implémentation
- Assess completed, attempted and proposed activity promptly; record the facts, grounds and time at which suspicion was formed.
- Preuves à conserver
- Alert chronology, information reviewed, suspicion decision and decision-maker.
- Source primaire
- Law No. 20 of 2019, article 21; QFIU STR Guidance 2024
Report suspicious transactions promptly to QFIU.
- Action d’implémentation
- Use ESTR when electronically connected; otherwise or for urgent cases use the current approved manual route and form. Follow current QFIU and sector timing instructions rather than inventing a fixed universal deadline.
- Preuves à conserver
- Suspicion timestamp, STR, submission receipt, route rationale and corrections.
- Source primaire
- Law No. 20 of 2019, article 21; QFIU Reporting Entities page; QFIU STR Guidance 2024
Prevent tipping off and protect report information.
- Action d’implémentation
- Restrict knowledge of STRs and related requests, control communications and disclose only where legally permitted.
- Preuves à conserver
- Access controls, disclosure register, legal review, training and incident log.
- Source primaire
- Law No. 20 of 2019, article 22
07Payments, wires, thresholds, and virtual assetsThreshold and licensing rules depend on the product, sector and transaction type.5 éléments+
Apply the QAR 50,000 occasional-transaction CDD threshold in its proper context.
- Action d’implémentation
- Aggregate linked operations and apply CDD at or above the threshold; apply CDD regardless of amount where suspicion or identity-data doubt exists.
- Preuves à conserver
- Aggregation logic, transaction samples, conversion rules and CDD outcomes.
- Source primaire
- Decision No. 41 of 2019; Law No. 20 of 2019, articles 9-12
Apply sector-specific precious-metals cash restrictions.
- Action d’implémentation
- For covered precious-metal, stone and jewellery transactions, implement the QAR 50,000 scope and cash prohibition under the applicable MoCI framework; do not generalise it to all sectors.
- Preuves à conserver
- Product classification, payment controls, aggregation tests and refusal records.
- Source primaire
- Law No. 4 of 2022; MoCI Circular No. 7 of 2024
Carry and review required wire-transfer information.
- Action d’implémentation
- Collect, validate, transmit and retain prescribed originator and beneficiary information and establish risk-based procedures for missing or incomplete fields.
- Preuves à conserver
- Field matrix, message samples, validation rules, repair queue and dispositions.
- Source primaire
- Law No. 20 of 2019, article 12; Decision No. 41 of 2019; QCB AML/CFT Instructions 2020
Obtain payment-service approval before launch.
- Action d’implémentation
- Classify wallets, payment aggregation, merchant acquiring, remittance and related services under the current QCB licensing framework and meet safeguarding, governance and technology conditions.
- Preuves à conserver
- Product memo, QCB approval, conditions, safeguarding records and test results.
- Source primaire
- Law No. 13 of 2012; QCB Payment Services Regulation
Treat virtual-asset activity as a separately controlled perimeter.
- Action d’implémentation
- Do not offer or facilitate virtual-asset services from or into Qatar without current written analysis of QCB and, where relevant, QFC restrictions or permissions and explicit regulatory confirmation.
- Preuves à conserver
- Service and wallet-flow map, legal opinion, authority correspondence, geofencing and monitoring tests.
- Source primaire
- QCB supervisory instructions; QFCRA virtual-asset notices; FATF-MENAFATF Qatar MER 2023
08Targeted financial sanctionsTargeted financial sanctions apply independently of an STR decision.3 éléments+
Screen UN and national designations and ownership or control.
- Action d’implémentation
- Screen customers, beneficial owners, controllers, representatives and transactions at onboarding and on list changes; test aliases and controlled entities, not exact names only.
- Preuves à conserver
- List versions, update logs, configuration tests, match analysis and dispositions.
- Source primaire
- Law No. 27 of 2019; Decision No. 1 of 2020
Freeze designated assets immediately and without prior notice.
- Action d’implémentation
- For UN or sanctions-committee designations, freeze immediately and without delay, no later than 24 hours, and follow the competent notification route; apply national designations immediately upon announcement.
- Preuves à conserver
- Designation receipt, match analysis, freeze timestamp, report and authority correspondence.
- Source primaire
- Law No. 27 of 2019, article 39; Decision No. 1 of 2020
Do not make funds or related services available to designated persons.
- Action d’implémentation
- Block direct and indirect provision, including through owned or controlled entities or persons acting on their behalf, unless prior competent authority permission applies.
- Preuves à conserver
- Ownership analysis, blocked activity, licence or permission and conditions monitoring.
- Source primaire
- Law No. 27 of 2019, article 39
09Records and regulator accessTen years is the national baseline, but the clock depends on the record.3 éléments+
Retain transaction records for at least ten years.
- Action d’implémentation
- Keep domestic and international transaction records sufficient to reconstruct activity for at least ten years from completion, subject to longer holds or authority directions.
- Preuves à conserver
- Retention schedule, transaction sample, trigger calculation, legal hold and deletion log.
- Source primaire
- Law No. 20 of 2019, article 19
Retain CDD and relationship records for the statutory period.
- Action d’implémentation
- Keep identity, verification, account, correspondence and analysis records for at least ten years after the relationship ends or occasional transaction completes, as applicable.
- Preuves à conserver
- End date, archive sample, retrieval test and deletion approval.
- Source primaire
- Law No. 20 of 2019, article 19
Produce records promptly to competent authorities.
- Action d’implémentation
- Maintain secure, retrievable and readable records and test authorised production while preserving confidentiality and chain of custody.
- Preuves à conserver
- Access matrix, retrieval test, production log and chain-of-custody record.
- Source primaire
- Law No. 20 of 2019, articles 19, 32 and 41
10Privacy, biometrics, and transfersAML processing does not remove personal-data obligations.4 éléments+
Process personal data transparently for a lawful purpose.
- Action d’implémentation
- Define the purpose and legal basis, provide required information to individuals, limit collection and use, maintain accuracy and implement data-subject request procedures.
- Preuves à conserver
- Data inventory, purpose map, notices, request log and accuracy controls.
- Source primaire
- Law No. 13 of 2016, articles 3-15
Protect special-nature data and biometrics.
- Action d’implémentation
- Identify special-nature data, obtain the competent permission where article 16 requires it, document necessity and proportionality, and apply heightened security, access and deletion controls.
- Preuves à conserver
- Data classification, permission analysis, privacy assessment, access logs and deletion tests.
- Source primaire
- Law No. 13 of 2016, articles 16-17
Control processors, security and personal-data incidents.
- Action d’implémentation
- Contract for instructions, confidentiality, security, incident escalation, return and deletion; maintain appropriate technical and organisational safeguards and evidence incident response.
- Preuves à conserver
- Processor contract, risk review, security tests, incident chronology and remediation.
- Source primaire
- Law No. 13 of 2016, articles 8-15
Assess cross-border data flows before transfer or remote access.
- Action d’implémentation
- Document the statutory transfer route, recipient safeguards and any restrictions or competent-authority requirements; preserve access for lawful AML supervision.
- Preuves à conserver
- Transfer map, legal assessment, contract, recipient diligence and monitoring.
- Source primaire
- Law No. 13 of 2016, including cross-border data-flow provisions
11Practical evidence packsEvidence should reconstruct onboarding, reporting and launch decisions end to end.3 éléments+
Maintain a reconstructable onboarding pack.
- Action d’implémentation
- Bundle identity, authority, KYB, beneficial ownership, PEP, sanctions, purpose, risk, privacy, approvals and exceptions under stable identifiers.
- Preuves à conserver
- Complete sampled onboarding pack and retrieval result.
- Source primaire
- Operational control supporting Law No. 20 of 2019, articles 8-19
Maintain a reconstructable QFIU and sanctions case pack.
- Action d’implémentation
- Link activity, alert, suspicion chronology, STR, receipt, confidentiality, asset restrictions and authority communications.
- Preuves à conserver
- Complete sampled case pack, timeline and controlled-access record.
- Source primaire
- Operational control supporting Law No. 20 of 2019, articles 19-22 and Law No. 27 of 2019
Maintain a launch and change pack.
- Action d’implémentation
- Record perimeter, licences, programme approval, reporting connectivity, sanctions, privacy, vendors, testing and controlled uncertainties before launch or material change.
- Preuves à conserver
- Signed launch pack, source register, tests, approvals and uncertainty log.
- Source primaire
- Official sources listed below
Registre des sources primaires
18 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- Law No. 20 of 2019 on Combating Money Laundering and Terrorism FinancingQatar Financial Information Unit · Primary legislation
- AML/CFT legislation and amendments libraryQatar Financial Information Unit · Official legislation library
- Council of Ministers Decision No. 41 of 2019Al Meezan Legal Portal · Primary delegated legislation
- AML/CFT Instructions for Financial Institutions 2020Qatar Central Bank · Official supervisor instructions
- Instructions to BanksQatar Central Bank · Official supervisor library
- QFIU reporting entities and filing routesQatar Financial Information Unit · Official FIU guidance
- Instructions on Suspicious Transaction Reporting Requirements, April 2024Qatar Financial Information Unit · Official FIU guidance
- QFIU role and functionsQatar Financial Information Unit · Official FIU information
- QFCRA AML/CFT Rules 2019Qatar Financial Centre Regulatory Authority · Official sector rules
- Local investor laws and Unified Economic Register materialsMinistry of Commerce and Industry · Official legislation library
- Business services, AML/CFT and beneficial ownershipMinistry of Commerce and Industry · Official registry and supervisor guidance
- Law No. 27 of 2019 on Combating TerrorismAl Meezan Legal Portal · Primary legislation
- Decision No. 1 of 2020 on targeted financial sanctionsQatar Financial Information Unit · Primary implementing decision
- Law No. 13 of 2016 on Protecting Personal Data PrivacyAl Meezan Legal Portal · Primary legislation
- Financial Crimes Enforcement ManagementQatar Central Bank · Official supervisor information
- FATF-MENAFATF Mutual Evaluation of Qatar 2023FATF · Authoritative assessment
- FATF jurisdictions under increased monitoring - 19 June 2026FATF · Authoritative current status
- FATF high-risk jurisdictions subject to a call for action - 19 June 2026FATF · Authoritative current status
Réponses directes
Questions KYC, KYB et AML pour Qatar
Who receives suspicious transaction reports?+
QFIU is the national FIU. Connected reporting entities use ESTR; entities not yet connected, and urgent cases, use QFIU's current approved manual route and form.
When must an STR be filed?+
A reporting entity must report promptly once grounds for suspicion arise. The checklist does not invent one fixed universal number of days; follow Law No. 20 of 2019, current QFIU guidance and the applicable sector instructions.
Is there an occasional-transaction CDD threshold?+
Yes. The national framework uses QAR 50,000 or more for covered occasional transactions, including linked operations. Wire transfers, suspicion and doubts about prior identification can trigger CDD independently and at lower amounts.
How is beneficial ownership determined?+
AML CDD requires the natural persons who ultimately own or effectively control the customer or on whose behalf activity occurs. For the company registry, the declaration cascade starts at 20% capital or voting control, then effective or legal control, then the legal representative fallback.
How long are AML/CFT records kept?+
The national baseline is at least ten years. The clock depends on the record, including transaction completion or the end of the business relationship.
How quickly must designated assets be frozen?+
Law No. 27 of 2019 requires immediate freezing without prior notice for relevant designations and states a maximum of 24 hours for UN or sanctions-committee listings. Operational controls should act as soon as a true match is established, not wait for the outer limit.
Can a payment or wallet service launch without QCB review?+
Do not assume so. Map the actual payment, wallet, acquiring or remittance service to the current QCB licensing framework and obtain the required approval before launch.
Are virtual-asset services freely permitted?+
No general permission should be inferred. Obtain current written analysis of QCB and any QFC restrictions or permissions and explicit regulatory confirmation for the actual service and customer flow.
What privacy law applies to digital identity data?+
Law No. 13 of 2016 applies to personal-data processing. Special-nature data, including biometric and health-related categories, requires heightened assessment and may require competent permission.
Is Qatar on a FATF public list?+
No. Qatar was absent from the FATF increased-monitoring and call-for-action lists dated 19 June 2026. That does not make every Qatar relationship low risk.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General regulatory information, not legal advice or a licence determination. Reviewed as applicable on 30 September 2026. Confirm the regulated perimeter, current supervisory instructions, filing channel, sanctions designation, privacy position and any Qatar Financial Centre overlay with the competent authority and qualified Qatar counsel before launch.