Tonga

Made on 1 October 2026 under the 2025 Act and in force the same day (reg 1(2)). Sets CDD rules (regs 3-12) with a beneficial ownership threshold of more than 25 percent (reg 4), compliance officer duties (reg 13), wire transfer and virtual asset transfer information rules (regs 16-17), electronic record retention (reg 18) and reporting forms (reg 19).

Made on 18 November 2025 under s 399 of the Companies Act and in force on gazettal. Prescribes forms and late-filing fees for the online Companies Register run by the Registrar of Companies. The text contains no beneficial ownership register or disclosure duty.

Act 15 of 2025. Creates offences of unauthorised access, modification and impairment of data and systems, interception, and use of communications services for threats and harassment. The heaviest individual penalties are $100,000 and 10 years' imprisonment (for example ss 8, 9, 11 and 14). It repeals the earlier Computer Crimes Act (s 78) and has no offence labelled computer fraud. Assented 28 August 2025; takes effect on a date proclaimed by Cabinet.

Act 14 of 2025. Establishes CERT (s 9), allows the Minister to designate critical infrastructure, with banking or other financial services named among the sectors considered (s 11(3)), and requires operators to report incidents to CERT within 24 hours (s 15) and to maintain cybersecurity policies (s 17). Court penalties reach $1,000,000 for a body corporate (s 19). Assented 28 August 2025; commencement by Cabinet proclamation. It has no separate regime for financial institutions.

Act 5 of 2025. Gives electronic information legal effect (s 8), sets rules on time and place of dispatch and receipt (ss 10-13) and recognises electronic signatures that identify the signatory and are reliable (ss 25-27). Excludes wills and conveyances of real property from Part III (s 16). The Minister responsible for digital transformation administers it. Assented 28 August 2025; commencement by Cabinet proclamation.

Act 34 of 2025. General data protection law. Requires a lawful basis for processing (s 27), notice on collection (s 33), security measures (s 36) and breach notification within 72 hours (s 37, which does not apply until the second anniversary of commencement). Gives access, correction, deletion and objection rights (ss 42-46) and restricts cross-border transfers (ss 39-40). Assented 16 December 2025; commencement by Cabinet proclamation.

Made on 13 September 2024 under s 53 of the Tonga Climate Change Fund Act 2021. Governs the Fund's project cycle, accreditation of implementing entities, reporting and offences. It is a public climate-finance rule, not a disclosure requirement for financial institutions.

NRBT directive regulating foreign exchange transactions between Tonga and the rest of the world, including dealings in gold, foreign exchange and foreign securities. The PDF is dated January 2023 and states it is issued under ss 6(2) and 32 of the Foreign Exchange Control Act 2018; the NRBT web page says it is effective June 2023, with no day given.

Issued under s 20(3) of the Banking Act 2020. Requires a Board-approved operational risk framework covering IT, business continuity, fraud and outsourcing, prior consultation with the Reserve Bank on material outsourcing (para 91), and reporting of material operational risk incidents within 24 hours (para 94). The standard does not mention cloud services.

Issued under s 20(3) of the Banking Act 2020. Requires a Board-approved cybersecurity framework and strategy, a designated CISO function and a set of technical controls, and sets incident reporting to the Reserve Bank (quarterly, and within 60 minutes for material incidents, paras 105-106).

Provides for the licensing, governance and supervision of microfinance institutions by the Reserve Bank. No institution may carry on microfinance business without a licence (s 3(2)); deposits may be taken only from members (s 3(3)) and minimum paid-up capital is $100,000 (s 12). The text read is the 2020 Revised Edition, which gives 21 June 2019 as the commencement date.

Act 2 of 2018. Requires a licence from the Reserve Bank to carry on moneylending in Tonga (s 3(1)); unlicensed lending carries a fine of up to $10,000, up to three years' imprisonment, or both (s 3(2)), and agreements made by an unlicensed moneylender are unenforceable (s 20). The text read is the 2020 Revised Edition, which gives 30 September 2020 as the commencement date.

Implements UN Security Council resolutions and conventions on terrorism and transnational organised crime. It criminalises providing or collecting funds for terrorist acts or groups (s 10), requires property of specified entities to be frozen, and provides for forfeiture. Commenced on 11 November 2013; the text read is the 2020 Revised Edition.

Founding statute of the central bank (Cap. 16.12, Act 48 of 1988, as in the 2020 Revised Edition). Section 43A makes the Bank exclusively responsible for the regulation, licensing, registration and oversight of payment, clearing and securities settlement systems, and the NRBT cites it as the base for its draft payment systems legislation.