Libya

Art. 29 requires identity documents, account files and analysis results to be kept for at least five years after the business relationship ends, and transaction records for five years after the transaction is attempted or completed.

Art. 19 bans anonymous and fictitious accounts and requires identification and verification of clients and beneficial owners, understanding of the relationship and continuous monitoring. Art. 20 allows simplified measures for low risk, and Art. 25 requires refusing or ending the relationship if due diligence cannot be completed.

Art. 27 requires institutions to report suspicious or attempted transactions to the Libyan Financial Information Unit without delay, whatever their value. Good-faith reports attract no civil, criminal or administrative liability (Art. 51), and disclosing a report to the client is prohibited (Art. 28).

Art. 12(1) requires separate accounts opened under the electronic-payment account name, and Art. 12(3) bars use of those pooled accounts in any form. Art. 15(1) requires the total balances in the pooled accounts at commercial banks to equal the e-money issued.

Art. 2 requires a valid practising permit from the National Authority for Information Security and Safety for seven listed services, including SOC management, penetration testing, incident response and consultancy. Art. 3 ties commercial licence renewal to a valid permit.