San Marino

SM · SMR · Europe

3 regulators · 10 laws & regulations · 7 obligations · 6 enforcement actions

Obligation	Timing	Regulator	Arises from	Source
All industries
Beneficial ownership reporting by companies and trusts	—	—	—	source
Art. 23 quater(1) requires companies and similar entities to report information on their natural-person beneficial owners to the Office for Industry, which keeps a restricted-access register; Art. 23 quater(2) covers trusts, reporting to the Office of the Trust Register. Art. 22 bis(2)-(5) sets how companies, foundations and trustees obtain and keep this information.
Confidentiality of persons reporting corruption-related facts	—	—	Urgent provisions to prevent and combat corruption offences – Decreto Legge 16 giugno 2014 n. 90 (Decree-Law no. 90 of 16 June 2014)	source
Art. 3 lets any person report relevant facts to the judicial or police authority and requires obliged entities under Law 92/2008 to report suspicious transactions and corruption-linked funds; good-faith reports carry no liability. Art. 4 requires the reporter's identity to be kept confidential unless the judicial authority finds disclosure essential, and bars obliged parties from telling the subject of a report.
Just cause or justified reason for dismissal of permanent staff	—	ULPA	—	source
Art. 4 of Law 23/1977 requires just cause (giusta causa) or justified reason (giustificato motivo) to dismiss permanent staff, and Art. 7 declares dismissal for union membership or activity null. Law 7/1961 sets notice and seniority indemnities.
Lawful basis, notice and data subject rights	—	Autorità Garante per la Protezione dei Dati Personali	Protection of Natural Persons with Regard to the Processing of Personal Data (Consolidated Text) – Legge 21 dicembre 2018 n. 171 (Law no. 171 of 21 December 2018)	source
Art. 5 lists the grounds for lawful processing, Arts. 13 and 14 require information to data subjects (within one month where data was not collected from them, Art. 14(3)), and Arts. 15-22 give rights of access, rectification, erasure, restriction, portability, objection and protection against automated decisions.
Personal data breach notification	Deadline Within 72 hours of awareness, where feasible	Autorità Garante per la Protezione dei Dati Personali	Protection of Natural Persons with Regard to the Processing of Personal Data (Consolidated Text) – Legge 21 dicembre 2018 n. 171 (Law no. 171 of 21 December 2018)	source
Art. 34(1) requires the controller to notify the Data Protection Authority not later than 72 hours after becoming aware of a breach, where feasible. Art. 35 covers communication to affected data subjects.
Banking
AML record retention	Retention period 5 years	—	—	source
Art. 34(1) requires records and copies to be kept for at least five years after the end of the business relationship, and Art. 34(2) applies the same period from the carrying out of a transaction or service. Art. 34 bis extends the duty to entities that have ceased reserved activities.
Crypto / VDA
VASP registration and authorisation before offering crypto services	Before offering services	BCSM	Decreto Delegato 3 gennaio 2024 n. 2 – Disciplina delle tecnologie basate su registri distribuiti (Delegated Decree no. 2 of 3 January 2024 – Regulation of distributed ledger technologies)	official
DD 2/2024 Art. 23(1) allows DLT operators to issue, offer or provide token services only after entry in the register of DLT operators (Art. 22), which depends on a UAE licence (Art. 22(5)); the Istituto per l'Innovazione decides within 30 days of a complete application (Art. 24(7)). Regulation 2024-03 Art. II.II.1 reserves crypto-asset services to crypto-asset firms with prior Central Bank authorisation and registration, and Art. III.II.7 sets a 180-day deadline for the first decision.
No obligations match these filters.