Lesotho

Section 15 sets the grounds for lawful processing, s. 25 requires notice to data subjects, and ss. 26-27 give rights of access, correction and deletion. Other principles are minimality (s. 16), purpose specification (s. 18), retention (s. 19) and security safeguards (s. 20).

Section 23 requires a controller to notify the Commission and the affected data subject where there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person. Notice is due as soon as reasonably possible after the compromise is discovered, and may be delayed where the police, the National Security Service or the Commission decide it would impede a criminal investigation (s. 23(3)).

Reg. 13(2) of the Money Laundering and Proceeds of Crime Regulations, 2019 requires accountable institutions to designate an officer at senior management level, who must know the institution's AML/CFT controls (reg. 13(3)). For banks, reg. 14(1)(a) of the CBL's 2015 Regulations requires policies for designating compliance or money laundering officers and reg. 15 an ongoing staff training programme. The Act (ss. 19-20 in the 2008 text, replaced by ss. 19-21A in 2016) adds internal reporting procedures, training and an audit function.

Section 17(4) of the Act requires records to be kept for at least 5 years from the date the business or transaction was completed. Reg. 11(4) of the 2019 Regulations repeats at least 5 years from the end of the business relationship or the occasional transaction, and reg. 11(5) lets a competent authority, supervisor or the FIU direct a longer period. The CBL's bank regulations set 10 years (see the row above).

Section 16 requires accountable institutions to establish the purpose and nature of the relationship and verify identity of natural persons and the legal existence and structure of entities. The 2016 Amendment Act extends s. 16 to beneficial owners, ongoing due diligence and politically exposed persons. Reg. 11(4) of the 2015 Regulations requires a customer acceptance policy and an ongoing identification and verification programme for banks.

Section 18(1) of the Act requires a report after forming suspicion and wherever possible before the transaction is carried out; the 2016 amendment extends it to attempted transactions. Reg. 19(2) of the Money Laundering and Proceeds of Crime Regulations, 2019 requires the report to the FIU 'immediately upon forming the suspicion' and 'not later than 7 days', with a written explanation if late (reg. 19(3)). Reg. 10 of the CBL's 2015 Regulations requires banks to report to the FIU and, for material activity, to the Commissioner.

Reg. 5 bars a company from issuing electronic payment instruments unless licensed under Part III or a financial institution under the Financial Institutions Act, 2012. The Central Bank may refuse a licence if the applicant lacks a Lesotho registered office, minimum core capital of M500,000 (Schedule 2) or fit-and-proper owners and officials (reg. 7). Licences run for one year (reg. 13).

Reg. 4(1) requires anyone carrying on money transfer business to apply to the Commissioner for a Type IV licence; banks are excluded (reg. 3(2)). Licences run for one year (reg. 10). Reg. 22 requires risk-based AML/CFT procedures including reporting suspicious transactions to the FIU. Reg. 17 and Schedule V require periodic returns, and reg. 23 allows penalties of up to M100,000 per contravention.

Reg. 18(2) requires prior notice to the Central Bank of outsourcing, and reg. 18(4) keeps the issuer responsible for outsourced functions and agents. Reg. 7(1)(c)(viii)(cc) requires contingency arrangements for safety, security and operational reliability, and Schedule 1, Part B, item 6 requires ICT security policies and disaster recovery plans with an application. The regulations contain no cyber-incident reporting duty.

Section 10(1) requires a Central Bank licence to operate a payment system in Lesotho; banks and companies not incorporated in Lesotho cannot be licensed (s. 10(2)). Licences last one year and are renewable for 12-month periods (s. 12). Operating without a licence is an offence (s. 34).

Reg. 35(1) requires issuers to deposit holder funds in a trust account at a Lesotho-licensed bank under Schedule 4. The trust balance must equal outstanding e-money at all times (Schedule 4, item 3(a)), funds may not be commingled (item 3(c)) and the Trust Deed needs Central Bank approval.