Tonga

Section 37(2) requires controllers to notify the Privacy Commission within 72 hours of becoming aware of a breach likely to risk individuals' rights and freedoms, and s 37(3) requires notice to individuals without undue delay where risk is high. Processors notify controllers within 72 hours (s 37(1)(a)). Section 37(11) delays application until the second anniversary of commencement.

Section 45(2)(a) requires records to be maintained accurately and securely for at least 7 years after the business relationship has ended, or from the transaction date for one-off transactions. Section 45(3)(a) applies the same period to CDD records, and s 45(3)(b) requires transaction records to be kept for at least 7 years from the transaction date.

Section 41(1) requires accountable persons to develop and implement internal programmes against money laundering, terrorist financing and proliferation financing, approved by senior management. Section 41(2) requires internal controls, independent audit, staff screening and training. Section 41(3) requires a compliance officer at senior management level; reg 13 of the 2026 Regulations adds unrestricted access to records.

Para 91 requires banks to consult the Reserve Bank before entering material outsourcing arrangements, inside or outside Tonga. Para 86 requires a legally binding written agreement submitted to the Reserve Bank for information and endorsement before the arrangement starts, and paras 88 and 91 require contracts to give the Reserve Bank access and on-site review rights.

Section 33 bars anonymous and fictitious accounts and requires CDD at account opening, on a material change in the relationship, where earlier identity information is doubtful and where crime is suspected, including identifying the beneficial owner (s 33(4)). Section 35(1) requires refusing to open the account or continue the relationship, and filing an STR, if identity cannot be verified. Regs 3-12 of the 2026 Regulations set thresholds ($10,000 for occasional transactions, $1,000 for wire transfers) and a beneficial ownership threshold of more than 25 percent.

Para 106 requires banks to notify the NRBT as soon as possible and not later than sixty minutes after becoming aware of an information security incident that materially affects, or could materially affect, the institution or depositors. Para 105 requires a quarterly report of all cybersecurity incidents on Form QCR.

Section 17(1) requires a report as soon as practicable and no later than 3 days after forming the suspicion, and within 24 hours where terrorism is suspected (s 17(1)(d)). Section 17(2) covers attempted transactions regardless of amount. Failure to report under ss 17 or 18 is an offence under s 28.

Reg 16(1) requires wire transfers to carry accurate originator and beneficiary information, and reg 16(2) bars proceeding if it cannot be obtained. Under reg 17, VASPs follow reg 16 except that the information need not accompany the transfer: it must reach the beneficiary VASP or institution immediately and securely (reg 17(2)), which holds it for at least 7 years (reg 17(3)). VASP CDD applies from $1,000 (reg 3(3)(b)).