Angola

Art. 12 requires unambiguous, express consent unless a listed exception applies; Arts. 13-14 add stricter rules for sensitive, health and sex-life data. Art. 25 requires controllers to tell data subjects who they are, the purposes, recipients and rights, within 30 days where data was not collected from the subject. Arts. 26-29 give rights of access, objection, rectification, update, erasure and refusal of solely automated decisions.

Art. 16(1) of Lei n.º 5/20 requires records to be kept for 10 years from the transaction or from the end of the business relationship; Art. 16(1) as amended by Lei n.º 11/24 gives the same period. Art. 23(2) of Lei n.º 5/20 sets 5 years for training records. BNA Aviso n.º 2/24 refers back to Art. 16.

Art. 22(1) of Lei n.º 5/20 requires an AML/CFT programme suited to the entity's sector, risks and size, with internal policies, procedures and controls, and compliance control systems including a person responsible at management level (Art. 22(1)(a)). Lei n.º 11/24 Art. 9(6)(a) requires policies approved by the management body. For banks, BNA Aviso n.º 2/24 makes the board appoint the compliance officer (Art. 34(2)(e)) and sets the officer's duties (Art. 35).

Art. 11 of Lei n.º 5/20 requires identification and verification of customers, representatives and beneficial owners when a relationship starts, for occasional transactions above the Annex thresholds, for wire transfers above a set value, on suspicion, or where earlier data is doubtful. Art. 12 deals with timing, Art. 13 with simplified measures and Art. 14 with enhanced measures including for politically exposed persons. BNA Aviso n.º 2/24 sets an occasional-transaction threshold equivalent to USD 15,000 (Art. 11(1)) and, where identity verification is postponed until after the relationship begins, a 15-day limit from its start (Art. 10).

Art. 8 of Aviso n.º 8/20 requires institutions to report breaches of networks or information systems, or losses of integrity, with a significant impact. The text says the first report must follow detection and is followed by status updates at 4-hour intervals until normal service is restored; it sets no hour limit for the first report.

Art. 10 of Aviso n.º 8/20 requires financial institutions to notify the BNA at least 60 days before contracting data processing, storage or cloud computing services, and at least 90 days before changing an existing cloud contract, with shorter periods allowed in justified exceptional cases.

Art. 17(1) of Lei n.º 5/20 requires entities to inform the UIF 'de imediato' on their own initiative when they know or have sufficient reason to suspect a suspicious operation. UIF Instrução n.º 001/DG-UIF/2026 (7 October 2026, Art. 3(2)) caps this at 24 hours from the moment the entity concludes a suspicion exists. BNA Aviso n.º 2/24 Arts. 27-29 set the reporting procedure for banks.

Aviso n.º 3/26 requires the governance model to include an irregularity-reporting policy and a whistleblowing channel (Art. 12(1)(n), (q)). Staff must be able to report without fear of reprisal (Art. 6(1)(e)), the board supervises the channel (Art. 6(5)(m)) and the supervisory body receives reports from shareholders, staff and others (Art. 20(1)(b)).

Art. 5 of Norma Regulamentar n.º 8/25 requires insurers, reinsurers, brokers and pension fund managers to assess their money laundering and terrorist financing risk, updating it at least every 12 months and submitting it to ARSEG by 31 March of the following year (Art. 5(2)); Art. 5(3) allows 24 months in justified cases.

Art. 11(3) of Aviso n.º 4/25 requires e-money issuers to hold resources matching account balances plus balances in transit and amounts received but not yet available. Art. 13(1) requires prudent management of those funds and redemption within one business day, and Art. 13(2) requires proof of liquidity for large or repeated redemptions.

Arts. 8-11 of Lei n.º 40/20 limit payment services to listed entities and require payment service companies and system operators to obtain BNA authorisation case by case. Art. 12 sets the application content, including procedures to protect users' funds (Art. 12(1)(a)(iii)); Art. 13 gives the BNA three months to decide; Art. 20 requires registration before starting activity. Art. 9(4) says funds received from users are not deposits.

Art. 10.º-B(2) of Lei n.º 5/20, as amended by Lei n.º 11/24, requires providers to keep originator and beneficiary information with a transfer and send it immediately and securely to the beneficiary provider, and to make it available to authorities on request. Art. 10.º-B(3) requires risk-based policies on executing, rejecting or suspending transfers that lack the information; Art. 10.º-B(1) applies due diligence to occasional transactions at the Annex threshold.