Lebanon

Art. 4(4) of Law 44/2015 requires records to be kept for at least five years after the operation or the end of the business relationship, whichever is longer. Basic Decision 7818 Art. 3(5) also sets a five-year minimum for customer, beneficial owner and operation records.

Art. 1 of Basic Decision 10227 requires each bank to prepare a business continuity plan, which under Art. 2 includes an alternate site, secure data transfer, staff training, testing and updating; a disaster simulation must be run at least once. The text says banks had one year from promulgation to prepare the plan, and Art. 4 has external auditors verify it exists and is adequate.

Art. 4 of Law 44/2015 requires banks and financial institutions to apply due diligence to permanent customers, to transient customers above a threshold set by Banque du Liban, and to identify and verify the beneficial owner (Art. 4(1)-(3)); due diligence applies regardless of thresholds where there is doubt or suspicion (Art. 4(6)). Art. 5 extends the duty to other listed institutions and professions. Basic Decision 7818 Art. 9 bis sets beneficial owner rules for legal persons, including a 20% capital threshold.

Art. 1 of Basic Decision 12872 requires banks, finance companies and other BDL-regulated institutions to take measures in line with the GDPR and to notify the BDL Compliance Unit and the Banking Control Commission by 31 December 2018, including a data protection officer chosen from the Compliance Unit and an EU representative. Art. 2 requires external auditors to verify compliance in their annual reports. The decision sets no data breach notification duty.

Art. 1 of Basic Decision 11323 requires banks and finance companies to establish a Compliance Department with a Legal Compliance Unit and an AML/CFT Compliance Unit. Art. 2 makes it independent of the bank's other activities with access to the Board and, for its head, direct access to Banque du Liban, the Banking Control Commission and the SIC. Art. 5(5) requires procedures to control and prevent money laundering and terrorist financing, and Art. 10 requires notice to BDL and the Banking Control Commission of the head's appointment or departure.

Art. 3 of BCCL Circular 272 keeps responsibility with the institution, including for sub-outsourced services, and requires documented studies before outsourcing and provider selection on competence, experience, financial strength and integrity. Contracts must cover subcontracting, service levels, confidentiality, security requirements, penalties, Commission access for on-site inspection, and termination and service-recovery arrangements, with exit strategies such as source code escrow.

Art. 2 of BCCL Circular 272 requires institutions to report disruptions to core IT or operational systems, including full or partial outages, systematic errors on customer accounts not fixed by the next business day, forced stoppages or breaches, and web-facing attacks or card fraud. The Commission must be notified within 24 hours of the incident being confirmed, with follow-up reports on Form ITSIRP01 until it is resolved.

Art. 7 of Law 44/2015 requires the parties covered by Arts. 4 and 5, including certified accountants and notaries, to report suspicious operations promptly to the Chairman of the SIC; lawyers report under a mechanism set by the Beirut and Tripoli Bar Associations. Art. 11 prohibits disclosing that a report has been or will be made. The Law states 'promptly' and no number of days.

Arts. 1-2 of Basic Decision 13790 require any non-bank institution providing electronic payment services to obtain prior approval from Banque du Liban, in one or more of five categories (A e-money, B local money transfer, C cross-border money transfer, D money collection and payment, E payment facilitators). Art. 3 requires a Lebanese joint-stock company with nominal shares and Art. 4 sets minimum capital of LBP 50 billion (categories A-D) or LBP 25 billion (category E). Art. 15 requires operations to start within six months of licensing.