Liechtenstein

Art. 3 and 4 VwbPG require legal entities to identify their beneficial owners and report them to the Amt für Justiz. Art. 4(4) sets an initial report within 30 days of entry in the commercial register (for Annex 1 entities), and Art. 4(5) requires changes to be reported within 30 days of becoming aware of them. Art. 31(2) allows fines up to CHF 200,000.

Art. 6 CSG requires essential and important entities to send an early warning within 24 hours of becoming aware of a significant incident and an incident notification within 72 hours. A final report is due no later than one month after the 72-hour notification. Art. 7 requires registration with the Stabsstelle, and changes must be reported within two weeks.

The DSG implements the GDPR nationally. It sets exceptions to the duty to inform (Art. 32, 33), the right of access (Art. 34), erasure (Art. 35), objection (Art. 36) and automated decisions (Art. 37); the Datenschutzstelle can fine breaches under Art. 40.

Art. 20 SPG: customer-related records, business correspondence and vouchers must be kept for ten years after the business relationship ends, and transaction-related records for ten years after the transaction is completed.

Art. 16(1) BankG requires banks to hold an FMA licence before starting operations. Art. 7 prohibits commercial banking business without a licence, and Art. 33 requires the FMA to withdraw a bank licence in the cases it lists, such as business not started within one year or a licence obtained through false statements.

Art. 5 SPG applies due diligence when a business relationship is entered into and in other set cases. The duties include identifying the contracting party and beneficial owner, preparing a business profile and monitoring the relationship on a risk basis. FMA Guidance 2018/7 sets review cycles (for example, business profile review every 1-2 years at elevated or high risk).

Art. 17 SPG requires obligated entities to notify the FIU in writing and without delay when there is a suspicion of money laundering, a predicate offence, organised crime or terrorist financing.

Section 11 of FMA-RL 2021/3 requires written ICT third-party policies, a criticality and risk assessment before contracting, due diligence, a register of contracts kept for at least five years after termination, access and audit rights for the FMA, and documented exit strategies. The Directive does not apply to entities covered by DORA.

The Act makes the FMA the competent authority (Art. 20). Art. 6(2) requires prior notification to the FMA of changes such as amendments to statutes or outsourcing of important functions, and Art. 6(3) requires immediate notification of events such as loss of an authorisation condition. Art. 26(e) makes unauthorised crypto-asset services an offence.

Art. 12 TVTG requires persons seated or domiciled in Liechtenstein who provide VT services professionally to apply in writing to the FMA for registration before starting. Art. 19 requires the FMA to decide within three months, and services may start only after entry in the register; Art. 28 requires changes and cessation to be reported.