Seychelles

Section 5 requires each legal person or arrangement to keep a register of beneficial owners at its resident agent's office and submit particulars to the FIU. Section 10(2) requires the register to be updated within 14 days of a new declaration, and s. 10(3) requires a beneficial owner to give notice of a relevant change within 14 days.

Section 15(2) lists the grounds on which personal data may be processed, including the data subject's consent. Sections 26-32 give data subjects the right to be informed, to access, rectify, delete, object, port their data and to compensation. Controllers must keep a record of processing activities (s. 37(1)).

Section 43(1) requires the controller to notify the Information Commission of a breach not later than 72 hours after becoming aware of it. Under s. 44(1), where a breach is likely to affect a significant number of individuals the controller must promptly inform the affected data subjects.

Section 47(2) requires records to be kept for a minimum of 7 years from the date the identity evidence was obtained, the transaction took place or the business relationship ended. Section 47(3) requires banks, bureaux de change, insurance companies and securities exchange infrastructures to keep records in digital form for 30 years after the business relationship ends.

Section 33(1)(a) requires reporting entities to implement internal policies, procedures and controls to fulfil their obligations under the Act. Section 34(1) requires a compliance officer to be appointed within 30 days of the Act's commencement or of starting operations, subject to supervisory approval, and s. 34(4) sets a fine of up to SCR 200,000 for failing to do so.

Section 2 of the Outsourcing Guidelines requires institutions to obtain Central Bank authorisation before entering an outsourcing arrangement, and para. 12.1 lists the documents to submit, including the Board-approved policy, risk assessment and draft agreement. Para. 4.1(iii) requires Board approval of material outsourcing, and para. 10.1(v) requires customer consent and notice to the Central Bank where confidential customer information is disclosed.

Section 35(1) requires CDD on customers, business relationships and transactions, plus ongoing monitoring (s. 46). CDD is carried out before or during establishment of the relationship (s. 39(1)). Section 40 allows simplified CDD for low risk, s. 41 requires enhanced CDD for higher risk, and s. 36 requires enhanced measures for politically exposed persons.

Directive No. 2 of 2025, issued on 16 May 2025, requires reporting entities supervised by the Central Bank to review CDD and beneficial ownership information at least annually for high-risk customers, every three years for medium-risk and every four years for low-risk customers. It sets no calendar date and tells entities to start reviews immediately.

Section 48(1)(a) requires a suspicious transaction report to the FIU within two business days of ascertaining reasonable grounds, and s. 48(1)(b) requires the FIU to acknowledge receipt within 24 hours. A compliance officer who fails to report faces up to 3 years' imprisonment, a fine of up to SCR 400,000, or both (s. 48(5)).

Section 7(1) prohibits acting as a payment service provider without a Central Bank licence; banks and credit unions are exempt but subject to oversight (s. 7(6)-(7)). Section 28(4) provides that in a provider's insolvency customer funds are used solely for payment users' claims. Section 7A requires 30 business days' written notice before extending product or service offerings. The text read contains no explicit trust-account rule.

The Fourth Schedule of the VASP Act inserts ss. 45B-45G into the AML/CFT Act. Originating providers must collect and keep originator and beneficiary information for each transfer (s. 45B), beneficiary providers must collect, record and verify it (s. 45C), and intermediaries must identify transfers missing information (s. 45E) while every provider monitors for it (s. 45F). Item 5 of the Third Schedule to the AML/CFT Act requires VASPs to report transfers of SCR 50,000 or more.

Section 18(1)(i) requires directors to notify the FSA in writing within 12 hours of becoming aware that a cyber-security event has occurred, with a written report within five working days (s. 18(2)). Section 22(1) requires appropriate and effective cyber security measures as prescribed, and the Cyber Security Requirements Regulations (reg. 7) add a 24-hour notice of attempts and a 5-working-day report on successful events. Section 21(1)(d) requires an annual cyber security report in January.

Section 5(1) prohibits carrying on, or purporting to carry on, the business of virtual asset services without a licence from the FSA. Section 42 required existing providers to apply by 31 December 2024; the FSA has since published warnings and enforcement statements on unlicensed operators.