Sudan

Art. 18 lets a customer obtain a copy of their credit report and appeal its accuracy; the agency must review an appeal within 15 days (Art. 18(3)) and the customer may escalate to the Governor within two weeks (Art. 18(4)). Art. 16(4) requires information providers to correct proven errors within 10 days, and Art. 17(6) requires users to tell a customer when a credit report is used in a financing decision. This is a sector rule, not a general data protection regime.

Art. 6 of the 2014 law requires institutions to adopt internal systems covering policies, procedures, monitoring, compliance, appointments, training and audit; the law does not itself name a compliance officer. Circular 8/2014 para. 55(b) requires a compliance officer at senior management level reporting to the Board, with a deputy, and the Central Bank must be told of any replacement.

Art. 6 requires identification, transaction, suspicious-transaction and risk-assessment records to be kept for at least five years; customer records run from the end of the relationship or occasional transaction, whichever is longer. Circular 8/2014 para. 48 repeats this and adds AML training records.

Art. 27 requires exchange companies to comply with the AML/CFT law of 2014 and Central Bank directives, and Art. 7(2)(b) requires founders to give a written undertaking to that effect before final licensing. Art. 15 allows the Governor to cancel a licence for breach of the AML/CFT law or Central Bank directives.

Art. 6 requires institutions to notify the Financial Information Unit immediately (فوراً) when they suspect, or have reasonable grounds to suspect, proceeds of crime or money laundering or terrorist financing links. Art. 9 prohibits tipping off and Art. 10 protects good-faith reporters. Circular 8/2014 paras. 49 to 50 route reports through the compliance officer, including attempted transactions.