Albania

Reporting entities (defined in Art. 2(1)) must register their beneficial owners with the National Business Centre: at the same time as company registration under Art. 5(3)(a), and within 40 calendar days of registration as a legal person for non-profit organisations (Art. 5(3)(c)). Changes must be registered within 90 calendar days of the actual change (Art. 5(3)(ç)). Art. 13 sets fines, for example 400,000 lek for a late change.

Art. 7(1) sets the lawful bases for processing and Art. 8 the conditions for consent. Arts 13-20 give data subjects the rights to information, access, rectification and erasure, to be forgotten, restriction, portability, objection, and rights concerning automated decisions.

Art. 29(1) requires the controller to notify the Commissioner no later than 72 hours after becoming aware of the breach. A controller that notifies late must explain the delay.

Art. 11(1)(a) requires reporting entities to draft, update and implement internal policies, including a customer acceptance policy and enhanced due diligence for high-risk relationships. Art. 11(1)(b) requires a compliance officer for AML/CFT at management level, and Art. 11(1)(b/1) requires that person to have sufficient risk knowledge and decision-making authority. Art. 11(1)(d) requires staff training and Art. 11(1)(dh) an internal control function.

Art. 4 requires due diligence before a business relationship is established, for transactions at or above set lek thresholds, when earlier identification data is in doubt, and whenever money laundering or terrorist financing is suspected. Art. 4/1 lists the measures, including identifying and verifying customers and beneficial owners and, in point (ë), continuous monitoring of the business relationship. Art. 5 covers identification documents.

Art. 15 requires quarterly reporting of early-warning indicators (Annex 1) and operational-risk events (Annex 3), and ad hoc reporting of events the entity classifies as critical or whose gross loss exceeds 2% of regulatory capital. An event is classified as critical within a reasonable time and no later than 24 hours after discovery; an initial report is due within 4 hours of that classification, an intermediate report within 3 working days of the initial report and a final report within 20 working days after business returns to normal. Applies to payment and e-money institutions as well.

Art. 11(2) requires procedures for risk assessment before and during the use of third-party services or functions, Art. 13(2) requires monitoring of outsourced services, and Art. 14(2)(g) requires policies for managing the risk of transferring processes or functions to third parties. No cloud-specific or prior-notification rule was seen in the regulation.

Art. 10(1) requires the sender's and beneficiary's name, address and ID or account number to accompany transfers, and Art. 10(6) states that the Art. 10 obligations also apply to providers of virtual asset services. The text does not use the term travel rule.

Art. 2 (points 25-26) defines virtual assets and virtual asset service providers, including exchange, transfer and custody, and Art. 3(l) makes any person providing virtual asset services a subject of the law. The CDD, record-keeping and reporting duties therefore apply to them.