Qatar

All anti-money laundering compliance obligations in Qatar are mandatory statutory obligations, which entail criminal and civil liability for corporate executives and compliance officers [Law No. 20 of 2019]. Compliance is guided by Law No. 20 of 2019 [Law No. 20 of 2019] and strengthened by Decree-Law No. 18 of 2025 and applies to mainland Qatar and to the offshore Qatar Financial Centre (QFC). This regulatory requirement includes continuous transaction monitoring instead of one-time verification [Law No. 20 of 2019], together with a strict five-year requirement to maintain records of all CDD data [Law No. 20 of 2019]. Designated MLROs have to perform immediate asset freeze orders under the Targeted Financial Sanctions (TFS) regulations and must comply with confidentiality rules, since notifying investigated customers leads to heavy criminal sanctions [Law No. 20 of 2019]. The consequences of non-compliance are quick actions taken by either QCB or QFCRA, including administrative bans, suspension of business licenses, or statutory penalties between QAR 1,000,000 and QAR 5,000,000.

The record retention obligation under the AML Act in Qatar is an enforceable, legal, and statutory obligation that exists to secure crucial evidence regarding financial transactions for purposes of investigation [Law No. 20 of 2019]. It is governed under Article 7 of Law No. 20 of 2019 [Law No. 20 of 2019] and compels entities under its coverage to archive their records of transactions, account information, and all customer due diligence information for at least 5 years [Law No. 20 of 2019]. The period for retention starts after the completion of the transaction or 5 years after the termination of business relationships [Law No. 20 of 2019]. Records should be complete enough for full reconstruction of the transaction process to allow the data to be presented before a court of law and should be easily accessible upon the request of the QFIU. Violation of this provision and destruction of the record is a serious non-compliance and exposes institutions and their officials to suspension or banning from doing business and/or a statutory fine of between QAR 1,000,000 and QAR 5,000,000 [Law No. 20 of 2019].

Customer Due Diligence (CDD) and KYC obligations in Qatar are a statutory requirement that is mandatory in nature, meant to verify customers' identity in order to keep the financial system safe from being used for criminal activities [Law No. 20 of 2019]. This requirement is governed under Law No. 20 of 2019 [Law No. 20 of 2019] and further enshrined through Decree-Law No. 18 of 2025 in the mainland and offshore Qatar Financial Centre (QFC) jurisdictions, compelling the entities under coverage to identify and verify all customers before starting any relationship. CDD obligations in Qatar are guided by a risk-based approach, whereby entities are required to identify the true Ultimate Beneficial Owner (UBO) at the threshold of 20% or above, and also conduct Enhanced Due Diligence (EDD) for risky customers such as Politically Exposed Persons (PEPs) [Law No. 20 of 2019]. The requirement strictly forbids the opening of anonymous accounts, and mainland entities are expected to use the state's biometric e-KYC digital verification mechanism.

The Suspicious Transaction Reporting (STR) obligation in Qatar is a statutory obligation that represents the core trigger mechanism of national financial investigations [Law No. 20 of 2019]. Regulated under Law No. 20 of 2019 [Law No. 20 of 2019] and further reinforced by Decree-Law No. 18 of 2025 in the mainland and offshore Qatar Financial Centre (QFC) areas, this obligation requires reporting a transaction when there are "reasonable grounds" for suspecting that the money is involved in some sort of crime [Law No. 20 of 2019]. The reporting process needs to be performed quickly and in electronic mode on the protected website of the Qatar Financial Information Unit (QFIU) and includes both completed and attempted transactions. The system imposes an absolute prohibition on tipping-off and, at the same time, grants full statutory protection against all liabilities of any kind for disclosure in good faith [Law No. 20 of 2019]. Non-compliance results in the immediate enforcement action taken either by the Qatar Central Bank (QCB) or QFCRA, which can range from revoking of operating license, administrative prohibition, imprisonment, or a fixed statutory fine between QAR 1,000,000 and QAR 5,000,000 [Law No. 20 of 2019].

The Lawful Basis, Notice, and Data Subject Rights Obligation in Qatar is a legally binding statutory requirement that seeks to protect the privacy of individuals and regulate data processing by companies [13/2016]. It is mandated under Law No. 13 of 2016 [13/2016] and enforced by the National Cyber Security Agency (NCSA) on the mainland, requiring both public and private organizations to create a standard legal basis for their operations through either explicit or implied prior consent before processing any personal information. This requirement obliges organizations to provide privacy notice about purposes for processing and disclosure to third parties while complying with codified rights of data subjects (access, correction, erasure, and objection) within a mandatory 30-day period. Moreover, processing of "special nature" metrics (biometric, genetic, or children’s data) is forbidden unless specific approval is granted by NCSA. Enforcement of this obligation may result in the issuance of obligatory remedial orders or fixed administrative fines between QAR 1,000,000 and QAR 5,000,000 per violation.

Personal Data Breach Notification obligation in Qatar is a compulsory and legal requirement aimed at mitigating privacy risks after any kind of security breach [13/2016]. This obligation is governed by Law No. 13 of 2016 [13/2016] and is enforced on the mainland through the National Cyber Security Agency (NCSA). It implies that in case there is a security breach and there is an imminent risk of serious harm to the individual's privacy or data, the controller shall notify the NCSA and all affected individuals without delay, but not later than 72 hours from the date of detection. It involves giving a detailed description of the incident in terms of the scale of the affected data, the likely consequences, and the remedial measures put in place to mitigate the risk of harm. Failure to meet the timely notification requirement or concealment of the breach results in serious enforcement penalties, with either a fixed fine of between QAR 1,000,000 and QAR 5,000,000 or the obligation to correct the breach.