Oman

Art. 10 requires the data subject's explicit written consent, which the controller must be able to prove. Art. 11 gives rights to withdraw consent, obtain a copy of data, request correction or restriction, request erasure and portability; Art. 12 provides a complaint to the Ministry.

Art. 12 treats dismissal as arbitrary if it results from the worker filing a complaint, report or claim against the employer, unless the complaint is malicious. Art. 8 requires employers with 50 or more workers to adopt a complaints and grievances system. The Law has no separate whistleblowing channel in the articles read.

Art. 44 requires transaction records to be kept for at least 10 years after the transaction and due diligence records for at least 10 years after the business relationship ends. Records must be available immediately to judicial authorities, the Centre and supervisors.

Art. 42 requires financial institutions, non-financial businesses and professions, and non-profit associations to apply AML/CFT programmes across the group: high hiring standards, ongoing staff training and an audit function to test effectiveness. The law does not define a compliance officer role; the CBO-FSA guidelines refer to a designated compliance function with a compliance officer or MLRO.

Art. 33 requires verifying customer identity from reliable independent sources before a business relationship, for wire transfers above a set threshold, on suspicion and where data is doubtful, and identifying beneficial owners. Art. 34 requires enhanced due diligence for high risk, Art. 35 bans anonymous accounts and Art. 36 requires ongoing monitoring and extra measures for politically exposed persons.

Cl. 3.5.1 requires licensed entities to notify the CBO of all significant breaches of consumer data without undue delay, and cl. 3.5.2 requires them to inform affected consumers, also without undue delay. Cl. 3.5.3 says the criteria for a significant breach will be issued later.

Art. 47 requires institutions to notify the National Centre for Financial Information immediately when they suspect, or have reasonable grounds to suspect, money laundering or terrorism financing, including attempted transactions. Art. 39 requires immediate notice where due diligence cannot be completed; Art. 49 prohibits tipping off.

Art. 6.7.2 requires open banking licensees to notify the Central Bank of outsourcing arrangements within five working days of signing the agreement. Art. 6.5.2 requires records to be kept for at least 10 years and Art. 6.8.13 requires independent testing of systems and controls on implementation, after material changes and at least every three years.

Arts. 2.1.1 and 2.2.1 require a CBO licence before providing or marketing open banking services (licensed banks notify the CBO and obtain a no-objection letter instead). Art. 2.3.4 sets base capital of OMR 100,000 for the open banking service provider category.

Thirteenth Principle: the board develops a CSR charter or code, management sets an annual CSR plan with budget and target communities, and the annual report carries a CSR report on activities, spend and impact. The Code describes itself as binding, though its Annex 2 standards mostly use "should".