Ecuador

Art. 48 requires records of transactions, due diligence data, analyses, account files and business correspondence to be kept for ten years after the end of the contractual relationship, the last transaction or the occasional transaction. Art. 52 sets ten years for wire transfer information.

Art. 34 requires obligated subjects to run a risk programme to detect, prevent, mitigate and manage money laundering, terrorist financing and proliferation financing, validated by the supervisor and independently tested. Sub-paragraph (h) requires naming management-level staff in charge of compliance as liaison with the UAFE and the supervisor.

Art. 43 requires identification and verification of the client and of anyone acting for it, identification of the beneficial owner of legal persons and trusts, understanding of the purpose of the relationship and source of funds, and ongoing monitoring. Art. 44 lists the data needed for legal persons and trusts; Art. 45 allows verification to be completed later only exceptionally, within five days; Art. 47 bars starting the relationship if due diligence cannot be completed.

Art. 34 lit. g requires obligated subjects' risk programmes to include policies on creating and managing channels for complaints and reporting to the authorities. Art. 23.3 prohibits justice operators, parties, lawyers and third parties from requiring or revealing the identity of a UAFE analyst, on pain of administrative, criminal or civil liability, and extends the protection to compliance officers and staff of obligated subjects who took part in suspicious-transaction reports. This is not a general whistleblower protection regime.

Art. 52 applies to national and cross-border electronic transfers, including virtual asset transfers, by obligated subjects including virtual asset service providers. Originator and beneficiary information and an account or reference number must accompany each transfer or message, including batch transfers, and be kept for ten years.