Namibia

Section 6(1)(b) prohibits prejudice to an employee for past, present or anticipated disclosure of information the employee is entitled or required to give, and s 33(2)(a) makes a dismissal for that reason unfair. No dedicated whistleblowing channel duty was found in the sections read.

Section 48(1) requires a public officer offered or given gratification in breach of the Chapter to report it to their supervisor and the Commission; s 48(2) requires anyone who demanded, accepted or tried to obtain gratification to report it. Failure to report is an offence (s 48(3)).

Section 18 requires the originating provider to obtain and send originator and beneficiary information with a transfer, and the beneficiary provider to obtain and keep originator and accurate beneficiary information. Breach carries up to N$10 million and 10 years' imprisonment (s 18(6)).

Section 7(1) bars a person from operating as a virtual asset service provider without meeting the listed conditions and holding a licence under the Act; s 7(2) sets a fine of up to N$10 million and up to 10 years' imprisonment. Section 54 requires existing providers to apply within three months of commencement.

Section 20A(1)-(2) requires regular ML/TF/PF risk assessment, including of new products and technologies before launch. Sections 20A(4)-(5) require a customer acceptance policy and internal programmes approved by senior management, s 20A(6) lists programme contents including an independent audit function, and s 20A(7) requires a management-level compliance officer who is ordinarily resident in Namibia.

Section 21(2) bars establishing a business relationship or concluding a single transaction until the client's identity, the beneficial owner and any agent's authority are established. Section 23(1A) requires a risk profile for each client, updated during ongoing due diligence, and s 24(1) requires information to be kept current and transactions monitored, with duties for high-risk and correspondent banking relationships.

Paragraph 12.1 requires immediate notification to the Director of Banking Supervision of material information or cyber security incidents, and para 12.5 requires a formal submission within 24 hours of detection (next working day if the incident falls on a weekend or public holiday). Takes effect six months after the 19 June 2026 gazette.

Section 25, as substituted in 2023, requires funds and assets of persons designated by the UN Security Council to be frozen without delay and without prior notice, and the Centre to be told without delay of frozen assets and actions taken. Making funds or financial services available to a designated person, knowing, ought reasonably to know or suspecting the designation, is an offence carrying up to N$100 million or 30 years' imprisonment.

Section 9.1 requires a bank to notify the Bank of Namibia and obtain prior authorisation at least 30 working days before signing with a provider for material outsourcing; Annexure 1 lists the documents to submit. Section 8.1 lists functions (credit lending, deposit-taking, treasury, and governance, risk, compliance and internal audit) that cannot be outsourced without the Bank's specific approval, and s 13.10 requires agreements to state the data hosting location.

Section 33(1) requires a person who knows or suspects that a transaction or activity involves proceeds of unlawful activity or ML/TF/PF to report it to the Centre promptly, irrespective of size. Section 33(4A) defines 'promptly' as without delay and not later than three days after the suspicion was formed. Tipping off is barred by s 33(3)-(4).

Section 11.23 requires a preliminary notification to the Bank within a maximum of 24 hours of a successful cyberattack. Section 11.24 requires an impact assessment within one month of the incident becoming known, and closure is reported on Annexure C.

Section 9 prohibits providing payment services without a licence or authorisation, and s 21 limits e-money issuance to the Bank and licensed providers. Section 22 requires e-money funds to be held in a separate trust account at a bank, audited annually; PSD-3 s 13.1.5 requires pooled funds to cover at least 100% of outstanding e-money.