Monaco

Art. 5 requires one of six lawful bases for processing, art. 6 sets consent conditions, art. 11 lists the information to be given at collection, and arts. 12-19 give rights of access, rectification, erasure, restriction, objection, portability and protection against solely automated decisions. Requests are answered generally within one month, extendable by two months (art. 10).

Arts. 7-8 set notice of one month after more than six months of service, two months after more than two years, and three months for managers with more than two years, halved when the employee resigns. Art. 9 requires notice by registered letter or signed receipt.

Art. 32 requires the controller to notify the APDP as soon as possible and, if possible, within 72 hours of becoming aware of a breach; a later notice must explain the delay. Processors notify the controller as soon as they become aware, and affected individuals are informed where the breach is likely to pose a high risk.

Art. 4 lists when due diligence applies, including business relationships and suspicion of money laundering or terrorist financing. Art. 4-1 requires identifying and verifying the client, agent and beneficial owner, art. 4-3 requires information on the purpose of the relationship and the client's background, and art. 5 requires constant vigilance. Under art. 7 an entity that cannot complete due diligence may not establish or maintain the relationship.

Art. 4 requires prior authorisation from the Minister of State to create an insurance company, which must be a société anonyme or société en commandite par actions. Art. 6 requires approval before operations start, and art. 9 allows withdrawal if the financial position gives insufficient guarantees.

Art. 4 bars delegation of all of a firm's activities and keeps the delegating company responsible for delegated activities. Art. 5 requires the delegation to specify its type, scope, duration, the delegate's resources, remuneration, controls and revocation conditions. The approval file must list delegations (art. 3) and the annual report must flag changes (art. 22).

Art. 2 requires prior CCAF approval for portfolio management, fund management, order reception, transmission and execution, advice and proprietary trading, with limited exceptions for group entities. Art. 3 limits approval to Monegasque sociétés anonymes or branches of foreign credit institutions.

Art. 14 requires prior authorisation for professional provision of the services in arts. 12-13 to third parties. Art. 17 lists the conditions, including honourable managers, AML/CFT compliance, own funds and insurance, IT resilience and Monegasque registration, and art. 19 requires them to be met continuously. The Minister of State grants authorisation after a commission opinion (arts. 14-15); the CCAF handles services on financial tokens.

Art. 2 requires a prior administrative label granted by the Minister of State after a reasoned opinion from a commission. Art. 5 requires the offering to run through a platform operated by an authorised digital-asset or crypto-asset service provider.