Seychelles

Issued by the Central Bank on 16 May 2025 under the AML/CFT Act, 2020 (ss. 35(1), 35(2)(c), 46 and 57(2)). It requires periodic CDD reviews at least annually for high-risk customers, every three years for medium-risk and every four years for low-risk customers, and tells entities to start immediately. It applies to banks, bureaux de change, the Development Bank of Seychelles, Housing Finance Company Limited, Seychelles Credit Union, leasing companies and payment service providers.

Made on 5 September 2024 by the Minister responsible for Finance under s. 38(2)(f)(iv) of the VASP Act. Licensees must keep a cyber security strategy reviewed at least annually (reg. 4), run penetration testing and vulnerability assessments (reg. 5), notify the FSA within 24 hours of a cyber security risk arising from an attempted event and report successful events within 5 working days (reg. 7), and keep a business continuity plan (reg. 11). The regulations set monetary penalties for breaches.

Makes the FSA the regulator of virtual asset service providers and prohibits carrying on virtual asset services without a licence (s. 5(1)). Licensees must notify the FSA in writing within 12 hours of listed events, including a cyber-security event (s. 18), lodge annual returns in January including a cyber security report (s. 21(1)), and maintain appropriate cyber security measures (s. 22(1)). The Fourth Schedule inserts travel-rule duties into the AML/CFT Act (ss. 45B-45G). Existing providers had to apply by 31 December 2024 (s. 42). Assented to on 26 August 2024 and commenced on 1 September 2024 under Commencement Notice SI 65 of 2024.

Issued by the Central Bank's Financial Surveillance Division under s. 11 of the National Payment System Act, 2014 and the amended Financial Institutions Act. They cover future and existing outsourcing by Central Bank-regulated entities and require Central Bank authorisation before an outsourcing arrangement is entered into (s. 2; para. 12.1 lists the supporting documents). The guidelines do not mention cloud services.

Continues the FIU as a body corporate (s. 10). Reporting entities must keep internal policies, procedures and controls (s. 33), appoint a compliance officer (s. 34), apply customer due diligence (ss. 35-41), monitor customers on an ongoing basis (s. 46), keep records (s. 47) and report suspicious transactions to the FIU within two business days (s. 48). Consolidated versions up to January 2025 are published by the FIU and the Central Bank.

Made by the Minister responsible for Finance on 27 August 2020 under the AML/CFT Act, 2020 and in operation from 28 August 2020. They cover registration of reporting entities with the FIU, appointment of compliance officers, simplified and enhanced customer due diligence, suspicious transaction reports and the Appeals Board, and repeal the 2012 Anti-Money Laundering Regulations. The FIU file is the original text; later amending regulations (2022 and 2024) are listed on the Central Bank and FSA pages.

Requires legal persons and legal arrangements to keep an accurate, up-to-date register of beneficial owners (s. 5) and names the FIU as nodal agency for the Seychelles Beneficial Ownership database (s. 13). Entities must update the register within 14 days of a declaration, and beneficial owners must give notice of a change within 14 days (s. 10). Penalties include up to SCR 50,000 for each failure in s. 5 and minimum fines of SCR 50,000 for obstructing access to registers. Assented to on 5 March 2020.

Issued by the Central Bank on 9 April 2019 for deposit-taking institutions such as banks and credit unions. Section 2.8 says institutions should notify the Central Bank within 24 hours of a cyber security incident that could significantly affect customers, reputation or financial condition, and provide a root cause analysis within 14 days of detection. The guidelines cite no statutory basis and state that they do not replace existing legislation.

Makes the Central Bank the licensing authority for payment service providers (s. 5(b)) and prohibits acting as one without a licence (s. 7(1)); banks and credit unions are exempt from licensing but subject to oversight. Section 35 sets conditions for electronic money issuers, and s. 28(4) ring-fences customer funds for payment users' claims on insolvency. The copy reviewed includes Act 15 of 2023.

Establishes the Financial Services Authority (s. 3) and makes it responsible for supervising and regulating licensees under the financial services legislation (s. 4(1)(a)). Section 28(1) allows a public statement where the Authority may take enforcement action, and s. 27(2)(e) allows administrative penalties provided for in the Act. Schedule 1 lists the regulatory and registry Acts it administers; s. 47(1) amends the Securities Act to replace 'Securities Authority' with the Financial Services Authority. The FSA publishes it consolidated to 1 September 2024.

Requires licences for securities exchanges (s. 7), securities dealers (s. 45) and investment advisers (s. 48). Part 10 (ss. 92-103) deals with insider dealing and other market abuses, and Part 8 includes s. 89 on continuing disclosure by issuers. The FSA publishes it consolidated to 18 December 2024 and lists the Securities (Amendment) Act, 2024. The consolidated s. 2(1) still defines 'Securities Authority' as the Central Bank, but s. 47(1) of the FSA Act replaces that term with the Financial Services Authority.

Establishes the Central Bank as an independent body corporate (s. 3), with price stability as its primary objective and financial stability as a further objective (s. 4). Its functions include licensing, regulating and supervising financial institutions (s. 4A(1)(d)) and promoting a safe national payment system (s. 4A(1)(g)). The CBS copy lists amendments up to Act 10 of 2024.