Togo

Art. 14 makes processing legitimate with the data subject's consent or on listed grounds such as legal obligation, contract or public interest. Art. 6 requires a declaration to the IPDCP and Art. 8 an authorisation for listed processing. Art. 35 gives a right to information and Arts. 39-40 access and copies; Art. 45 gives a right to object and Art. 46 rectification and erasure, with a one-month response period.

Art. 23 requires identity, customer-profile and due diligence records to be kept for ten years after the account is closed or the relationship ends, and transaction records for ten years after the transaction. Arts. 40, 50 and 56 repeat the ten-year period for wire transfers, casinos and non-profit organisations.

Art. 12 requires covered persons to adopt internal policies, procedures and controls and to designate one or more people responsible for implementation, plus a permanent independent compliance function where appropriate. Art. 13 sets internal control requirements for financial institutions and Art. 14 covers group-wide programmes.

Arts. 16-18 set the preconditions, identification and verification of customers and beneficial owners and the timing of verification. Arts. 19-21 require ongoing monitoring and special scrutiny, Art. 22 covers non-face-to-face relationships, Art. 26 legal persons and arrangements and Art. 29 politically exposed persons.

Art. 60 requires suspicious transactions to be reported to the CENTIF immediately. Art. 61 requires the entity to refrain from carrying out the transaction until it has reported, or to inform the CENTIF 'sans délai' if it was already carried out; Art. 2(58) defines 'sans délai' as a maximum of 24 hours. Art. 63 makes reports confidential.

Art. 84 requires major operational incidents to be notified without delay to the Central Bank and the Commission Bancaire, and clients whose interests may be affected to be informed without delay; a detailed incident report is due within 72 hours. Art. 3(26) defines a major incident, for example an outage of more than four hours or a security breach. Art. 83 requires penetration tests at least once a year.

Art. 28 requires at least 30 days' prior notice to the central bank and the Commission Bancaire before outsourcing a critical operational function. Art. 36 says outsourcing must not weaken internal control or supervision, and Art. 37 requires written contracts covering scope, exit terms, business continuity and at least annual performance indicators.

Art. 9 bars anyone from providing payment services without prior approval and listing, and Art. 11 sets minimum share capital from 10 million to 100 million FCFA depending on the service. Art. 48 requires customer funds to be kept separate from operating funds and, if still held at the end of the next business day, placed in safeguarding accounts with daily reconciliation.