AML compliance officer for COSOB-supervised entities
Algeria
—
—
source
View →
AML record retention for COSOB-supervised entities
Algeria
At least 5 years
—
source
View →
Suspicious transaction reporting for COSOB-supervised entities
Algeria
As soon as suspicion arises; immediately where CDD cannot be completed (Art. 22)
—
source
View →
AML/CFT policy, risk assessment and designated director (securities market)
Brazil
Ongoing; director notified to the CVM within 7 business days of investiture
—
source
View →
AML/CFT record retention (securities market)
Brazil
5 years minimum
—
source
View →
Customer due diligence and beneficial ownership (securities market)
Brazil
At onboarding + ongoing
—
source
View →
Suspicious transaction reporting to COAF (securities market)
Brazil
Within 24 hours of concluding the analysis
—
source
View →
ESG and climate-related disclosure in the annual report
Egypt
Annually, with the annual financial statements
—
source
View →
Customer due diligence for occasional transactions and wire transfers (licensed corporations and VASPs)
Hong Kong
Triggered by transactions at or above HK$120,000 (occasional) or HK$8,000 (wire transfers)
—
source
View →
Comply with the Cybersecurity and Cyber Resilience Framework (SEBI regulated entities)
India
Effective 1 January 2025 or 1 April 2025 depending on entity category
—
source
View →
Suspicious transaction and order reporting (market abuse)
Ireland
Without delay, on reasonable suspicion (as described by the Central Bank)
—
source
View →
Large shareholding report within five days
Japan
Within 5 days of exceeding 5% (Sundays and designated holidays excluded)
—
source
View →
AML/CFT reporting by CMA-licensed persons
Kuwait
Immediately (Art. 1-5)
—
source
View →
Delegation and outsourcing conditions for approved financial firms
Monaco
Ongoing
—
source
View →
Prior approval to carry on financial activities
Monaco
Before starting the activity
—
source
View →
AML/CFT record retention for SECP-regulated entities
Pakistan
5 years
—
source
View →
AML record retention (securities sector)
Panama
5 years from the end of the business relationship
—
source
View →
AML/CFT compliance programme and money laundering reporting officer (capital markets)
Rwanda
Policies reviewed at least every 3 years
—
source
View →
Retention of AML risk assessment records (capital markets)
Rwanda
10 years minimum
—
source
View →
AML/CFT compliance officer and MLRO (CMA-authorised persons)
Saudi Arabia
Ongoing; MLRO reports annually to the board (Art. 23(4))
—
source
View →
Suspicious transaction reporting to the FIU (CMA-authorised persons)
Saudi Arabia
Immediately; detailed report within 10 days; written confirmation within 24 hours of a telephone report
—
source
View →
AML record retention (CMA-authorised persons)
Saudi Arabia
10 years
—
source
View →
Customer due diligence (CMA-authorised persons)
Saudi Arabia
At onboarding + ongoing
—
source
View →
Technology incident reporting and recovery objectives for capital markets institutions
Singapore
Not later than 1 hour after discovery; root cause report within 14 days
—
source
View →
Applies across all sectors
Lawful basis, notice and data subject rights
Albania
—
—
source
View →
Personal data breach notification
Albania
No later than 72 hours after becoming aware of the breach
—
source
View →
Beneficial ownership registration and updating
Albania
Changes within 90 calendar days of the actual change
—
source
View →
Lawful basis, notice and data subject rights
Algeria
—
—
source
View →
Personal data breach notification
Algeria
No later than 5 days after becoming aware
—
source
View →
Appoint a data protection officer
Algeria
—
—
source
View →
Designate a person responsible for information systems security
Algeria
—
—
source
View →
Lawful basis, privacy notice and data subject rights
Andorra
Ongoing
—
source
View →
Personal data breach notification to the APDA
Andorra
Within a maximum of 72 hours of becoming aware (Art. 36)
—
source
View →
Lawful basis, notice and data subject rights
Angola
Ongoing
—
source
View →
File an annual beneficial ownership and control attestation with the Registrar of Companies
Antigua and Barbuda
Annually, within 30 days after the company's anniversary date
—
source
View →
Process personal data on a lawful basis, inform data subjects and honour their rights
Argentina
Ongoing; access within 10 calendar days; rectification or deletion within 5 business days
—
source
View →
Integrity programme for legal persons, required for certain contracts with the national State
Argentina
Ongoing; before contracting with the national State where Art. 24 applies
—
source
View →
Privacy policy, collection notice and individual access and correction rights
Australia
Ongoing
—
source
View →
Ransomware and cyber extortion payment reporting
Australia
Within 72 hours of the payment or of becoming aware of it
—
source
View →
Cybersecurity incident reporting by essential and important entities
Austria
Early warning within 24 hours of becoming aware; notification within 72 hours; final report within one month of the notification
—
source
View →
Internal whistleblowing channel
Austria
50 or more employees
—
source
View →
Lawful basis, information and data subject rights
Austria
—
—
source
View →
Personal data breach notification to the Datenschutzbehörde
Austria
Without undue delay and where possible within 72 hours of becoming aware
—
source
View →
Whistleblowing: internal channel for reports of corruption and protection of reporters
Azerbaijan
Reports considered within 20 working days
—
source
View →
Lawful basis, notice and data subject rights
Bahrain
Ongoing
—
source
View →
Personal data breach notification
Bahrain
Within 72 hours of discovery
—
source
View →
Lawful basis, notice and data subject rights
Bangladesh
Ongoing
—
source
View →
Keep basic and beneficial ownership information at the registered office
Barbados
Ongoing; kept at least 5 years; certified in each annual return
—
source
View →
Lawful basis, consent, notice and data subject rights
Belarus
Deadlines of 5 working days to 15 days depending on the request (Arts 10-13)
—
source
View →
Personal data breach notification
Belarus
Immediately, no later than 3 working days after becoming aware
—
source
View →
Data protection officer or dedicated unit
Belarus
—
—
source
View →
Keep employee records available for labour inspection for at least two years
Belize
At least 2 years after the record is made
—
source
View →
Protection of whistleblowers, witnesses and victims of corruption
Benin
—
—
source
View →
Private entities to supply information to the UIF and report suspected corruption
Bolivia
—
—
source
View →
Providers of public services to accept digitally signed documents and digital-citizenship acts
Bolivia
—
—
source
View →
Lawful basis, notice and data subject rights
Bosnia and Herzegovina
Ongoing
—
source
View →
Personal data breach notification
Bosnia and Herzegovina
Within 72 hours where possible
—
source
View →
Protection against dismissal for good-faith corruption reports
Bosnia and Herzegovina
Ongoing
—
source
View →
Lawful basis, notice and data subject rights
Brazil
Ongoing
—
source
View →
Personal data breach notification to the ANPD and data subjects
Brazil
Within 3 business days; preliminary notice completed within 20 business days
—
source
View →
Integrity (anti-bribery compliance) programme
Brazil
Ongoing
—
source
View →
Whistleblowing channel and protection against retaliation (public bodies and state-owned companies)
Brazil
Ongoing
—
source
View →
Consent, notification and data subject access and correction
Brunei
—
—
source
View →
Personal data breach notification to AITI
Brunei
No later than 3 days after assessing the breach as notifiable (s.28(1))
—
source
View →
Internal whistleblowing channel
Bulgaria
Acknowledge within 7 days; feedback within 3 months
—
source
View →
Protection of employees, witnesses and whistleblowers reporting corruption
Burkina Faso
—
—
source
View →
Lawful basis, notice and data subject rights
Cabo Verde
Ongoing
—
source
View →
Personal data breach notification
Cabo Verde
Within 72 hours of becoming aware
—
source
View →
Notification of data processing to the CNPD
Cabo Verde
Before processing starts
—
source
View →
Designation of a data protection officer
Cabo Verde
Ongoing
—
source
View →
Fair information principles: accountability, purposes, consent and individual access
Canada
Ongoing
—
source
View →
Annual forced labour and child labour supply-chain report
Canada
Annually by 31 May
—
source
View →
Confidentiality incidents: notification and incident register (Quebec)
Canada
Promptly where there is a risk of serious injury; no fixed deadline
—
source
View →
Protection against dismissal for complaints against the employer
Central African Republic
—
—
source
View →
Report significant cyber incidents to the national CSIRT
Chile
Early alert within 3 hours; update within 72 hours; final report within 15 calendar days
—
source
View →
Adopt a crime prevention model to avoid corporate criminal liability
Chile
Ongoing
—
source
View →
Lawful basis, notice and individual rights for personal information
China
Ongoing
—
source
View →
Personal information protection officer, audits and impact assessments
China
Ongoing; impact assessment before the activity
—
source
View →
Conditions for transferring personal information abroad
China
Before each transfer abroad
—
source
View →
Report cybersecurity incidents within 1, 2 or 4 hours
China
1 hour (CII operators), 2 hours (central government departments), 4 hours (others)
—
source
View →
Sign a written employment contract within one month of starting work
China
Within one month of the start of work
—
source
View →
Data subject rights and prior informed authorisation
Colombia
Ongoing
—
source
View →
Lawful basis, notice and data subject rights
Costa Rica
At collection + ongoing; access and rectification requests answered within five working days (Art. 7)
—
source
View →
Employers must allow labour inspection
Costa Rica
—
—
source
View →
Lawful basis, notice and data subject rights
Croatia
—
—
source
View →
Personal data breach notification to AZOP
Croatia
Within 72 hours of becoming aware
—
source
View →
Internal whistleblowing channel and confidential person
Croatia
Acknowledge within 7 days; feedback within 30 days, max 90
—
source
View →
Data subject rights and information on processing
Cuba
—
—
source
View →
Report ICT security incidents immediately
Cuba
Immediately ("inmediata"); no fixed deadline
—
source
View →
Whistleblowing channel and follow-up
Cyprus
Acknowledge within 7 days; feedback within 3 months of acknowledgement
—
source
View →
Cash payment limit of €10,000
Cyprus
—
—
source
View →
Internal whistleblowing channel for employers with 50 or more employees
Czechia
Acknowledge within 7 days; assess within 30 days of receipt
—
source
View →
Mining permit applicants commit to a community-responsibility cahier des charges
Democratic Republic of the Congo
At permit application and renewal
—
source
View →
Significant incident notification under the NIS 2 Act
Denmark
Early warning within 24 hours; notification within 72 hours; final report within one month
—
source
View →
Personal data breach notification to Datatilsynet
Denmark
Without undue delay and, where feasible, within 72 hours of becoming aware
—
source
View →
Internal whistleblower scheme for employers
Denmark
Acknowledge within 7 days; feedback within 3 months of acknowledgment
—
source
View →
Beneficial owner registration by companies
Denmark
Register as soon as possible; review at least annually; keep documentation 5 years
—
source
View →
Protection of whistleblowers, witnesses and experts from retaliation
Djibouti
Ongoing
—
source
View →
Data subject information, consent and rights (access, rectification, deletion)
Dominican Republic
Continuous
—
source
View →
Notice of dismissal to the labour authority
Dominican Republic
Within 48 hours of the dismissal
—
source
View →
No obligations for this country.