Montenegro

Art. 16(2) requires employers with at least 20 employees to appoint an impartial person or unit to receive reports, and Art. 16(10) requires an internal act on handling reports. Art. 17(1) requires acknowledgement within 7 days and an outcome notice within 45 days. Arts. 42-43 give 90 days from entry into force.

Art. 11(1)(5) requires reporting entities to appoint a compliance officer and a deputy. Art. 14 requires a risk management system with internal policies, controls and procedures, and Art. 12 requires an internal risk analysis act within 60 days of establishment or start of business.

Art. 17 lists the CDD measures, including identifying the customer and the beneficial owner. Art. 18 sets the triggers, for example occasional transactions of EUR 10,000 or more and crypto-asset transfers of EUR 1,000 or more; Arts. 19-20 set timing before the business relationship or transaction.

Art. 17(1) requires notice without delay and no later than 60 days before entering an outsourcing arrangement for critical or important functions or changing the provider. Art. 17(3) lists supporting documents. Art. 19 requires a register of all outsourcing, which for cloud arrangements records the cloud service type and deployment model.

Art. 35(1) requires large companies and parents of large groups with more than 500 employees to report on business model, policies, results, risks and non-financial indicators, in the management report or in a separate statement. Art. 35(4) removes the separate statement if the information is published with the management report, or on a website it refers to, within six months of the balance-sheet date.