Nicaragua

Art. 15 requires obligated entities to run prevention programmes with standard, simplified and intensified measures, management-level roles or units that monitor compliance, clear responsibilities for senior management, continuing AML/CFT training and an independent audit or evaluation function. Art. 16(7) requires group and individual risk assessments to be carried out annually. The term 'oficiales de cumplimiento' appears in the text only in Art. 36, on corrective measures and sanctions.

Art. 25 requires transaction records and the originator and beneficiary data of electronic transfers to be kept for at least five years after the transaction or transfer. Due diligence records, account files, business correspondence and analysis results must be kept for at least five years after the business relationship ends or the occasional transaction takes place, and records required by supervisors' rules for no less than five years.

Art. 41 establishes the Administrador de Prevención LD/FT, with appointment, qualifications and functions in Arts. 42-51; the board appoints this officer (Art. 6(h)). The programme (SIPAR) is documented in a manual approved by the board (Arts. 4 and 6(b)) and is subject to an annual external audit (Art. 7(e)(ii)).

Art. 17 requires identification of the customer when a business relationship starts, for occasional transactions above the supervisor's threshold, for non-face-to-face electronic operations and where there is suspicion or doubt about earlier data. The beneficial owner must be identified and reasonably verified, the customer's declared business activity recorded before the relationship begins, and transactions monitored throughout. Anonymous and fictitious-name accounts are prohibited. The SIBOIF norm details the process in Arts. 8-17.

Art. 42, as amended on 26 August 2011, requires institutions to notify the Superintendent formally and immediately of events such as successful external attacks or intrusions through network services, activation of IT contingency plans and interruptions of main systems affecting customer services. The institution must then give the outcome and the corrective actions taken within the following 24 hours.

Art. 3 allows only entities with a BCN licence or registration to operate as a payment service provider (PSP) or virtual asset service provider (PSAV); the two are separate licences. Banks supervised by the SIBOIF need no licence but must register with the BCN. Art. 7 requires the provider to ask the BCN for authorisation to start operations, and the BCN decides a licence application within 90 business days of a complete file.

Art. 3 allows only entities holding a BCN-issued licence to administer an electronic payment system. Art. 5 gives the BCN up to 90 business days to decide an application, and the administrator must request BCN permission before starting operations.

Art. 3 allows only entities with a BCN licence or registration to operate as remittance payment service providers (PSPR) or currency purchase and exchange providers (PSCM); each is a separate authorisation. Natural persons, and legal persons other than SIBOIF-supervised banks and CONAMI-supervised microfinance institutions, need a licence; those banks and institutions must register with the BCN before offering the services.

Art. 8(d) requires PSPs that issue electronic money or hold user funds in payment accounts to keep those funds segregated from their own funds and deposited in authorised financial entities. Art. 8(e) requires PSAVs holding customers' virtual assets or fiat to apply security measures against loss, theft or unauthorised access, including secure storage and fund segregation.