Vanuatu

Section 15(1) says data collected in Vanuatu must not be used elsewhere without the Minister's prior authorisation on the Deputy Commissioner's recommendation; s 15(2) and s 17 set exceptions, including transfers to prescribed countries and transfers with explicit informed consent.

Section 5 lists the lawful grounds for processing, s 4(1)(a)(ii) requires fair and transparent processing, and ss 9-13 give data subjects rights of access (free of charge within one month), restriction, rectification and erasure, objection and protection from solely automated decisions.

Sections 54-56 give employees with at least 12 months' continuous service severance allowance on listed triggers, at one month's remuneration for every 12 months of service; a court may order up to six times that amount if termination was unjustified (s 56(4)).

Section 34(1) requires a reporting entity to appoint an AML and CTF compliance officer. Section 33 covers the AML and CTF Procedure Manual and s 33(2A) requires periodic independent review by an external auditor.

Section 12 requires reporting entities to identify the customer and, under s 12(2)(c), any beneficial owner where a person acts for another. Verification is covered in s 16 and ongoing monitoring in s 17. The Regulation (Order 122 of 2014) sets the identification details and documents in cl. 3-4 and Schedule 2.

Section 19(3) requires transaction records to be kept for six years after the transaction is completed, and s 19(7) requires identity and verification records to be kept for six years after the account or relationship ends.

Section 37B(2) requires sender name, account number or tracing information and a further identifier for transfers of VT 100,000 or more, and s 37C sets sender and receiver requirements for international transfers below that. Sections 37B(9) and 37C(6) bar execution of a transfer if the information requirements are not met.

Clauses 12 and 13 set a VT 1 million reporting threshold for cash transactions and international currency transfers, with lower cash thresholds for some sectors. Reports are due within 10 working days for vatu and 2 working days for foreign currency (cl. 12(3)-(4), 13(2)-(3)).

Section 20(1) requires a suspicious transaction report to reach the VFIU not later than two working days after the suspicion arises; s 21 applies the same period to suspicious activity reports. Section 26(3) requires an oral report to be followed in writing within 24 hours.

Section 10(1) bars payment services and system operation without a Reserve Bank licence. Section 36 requires e-money to carry no credit, be issued against vatu or highly liquid assets and be redeemable at par, and says funds received for e-money are not deposits.

Section 23 requires written Reserve Bank approval for outsourcing by a payment service provider, and s 24 requires Reserve Bank approval for agents, which are entered in a public register.

Section 10(1) and (2) bar anyone other than a licensed company from carrying on VASP business. Section 11 sets the licence classes and s 12 the application process; penalties for unlicensed activity are set in s 10(3).

Section 27 sets travel-rule obligations: originator and beneficiary information for cross-border virtual asset transfers of USD 1,000 or EUR 1,000 or more.