Azerbaijan -- AML/CFT Compliance Regulatory Overview

Azerbaijan, as a member of the Eurasian Group on Combating Money Laundering and Financing of Terrorism (EAG), which is an FATF-style regional body, is committed to implementing international standards for Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT). While specific, standalone cryptocurrency regulations are still evolving, the existing AML/CFT framework has been extended to cover Virtual Asset Service Providers (VASPs) in line with FATF Recommendation 15.

AML/CFT Legislation in Azerbaijan

The primary legislation governing AML/CFT in Azerbaijan is:

1. Law of the Republic of Azerbaijan on Combating the Legalization of Criminally Obtained Funds or Other Property and the Financing of Terrorism (often referred to as the AML/CFT Law).
   • This law defines the scope of reporting entities and their obligations. Amendments have been made over time to align with international standards, including those relating to new technologies and virtual assets.
   • Key Principle: The law's definitions of "property" and "financial operations" are broad enough to encompass virtual assets and related services, thus bringing VASPs under its purview, even if they are not explicitly named in every article. FATF's guidance strongly recommends this approach for member countries.

Authority Overseeing Compliance

The primary authority responsible for supervising and enforcing AML/CFT compliance for financial institutions and designated non-financial businesses and professions (DNFBPs), which now includes VASPs, is:

• Financial Monitoring Service of the Republic of Azerbaijan (FMS)
  • The FMS acts as Azerbaijan's Financial Intelligence Unit (FIU), responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs). It also supervises compliance with AML/CFT requirements.
  • Website: https://www.fms.gov.az/

AML/KYC Requirements for Cryptocurrency/Virtual Asset Service Providers (VASPs)

In line with FATF recommendations and the spirit of Azerbaijan's AML/CFT Law, VASPs operating in Azerbaijan are expected to implement the following:

1. Registration/Licensing

While specific licensing for crypto activities might still be developing, VASPs are generally expected to register with relevant authorities and comply with business registration requirements. The FMS will likely expect VASPs to identify themselves as reporting entities.

2. Customer Due Diligence (CDD) Requirements

VASPs must conduct robust CDD on their customers, following a risk-based approach. This includes:

• Identification and Verification:
  • Individuals: Obtaining and verifying the customer's full legal name, date of birth, address, and unique identification number (e.g., passport number, national ID card number). Verification typically involves reliable, independent source documents or data.
  • Legal Entities: Obtaining and verifying the legal name, registration number, address, articles of incorporation, and identifying the natural persons who are the beneficial owners (typically those owning 25% or more of the entity's shares or voting rights, or exercising control through other means).
• Purpose and Nature of Business Relationship: Understanding the purpose and intended nature of the business relationship.
• Source of Funds/Wealth: For high-risk customers or transactions, obtaining information on the source of funds or wealth used in the virtual asset transactions.
• Ongoing Monitoring: Continuously monitoring the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes monitoring for unusual transaction patterns.
• Enhanced Due Diligence (EDD): Required for higher-risk scenarios, such as:
  • Transactions with Politically Exposed Persons (PEPs).
  • Customers from high-risk jurisdictions identified by FATF or the FMS.
  • Complex, unusually large transactions or unusual patterns of transactions with no apparent economic or lawful purpose.
  • Cross-border virtual asset transfers to/from jurisdictions with weak AML/CFT regimes.
• Simplified Due Diligence (SDD): May be applied in very limited, low-risk circumstances, as defined by internal risk assessments and regulatory guidelines.

3. Suspicious Transaction Reporting (STR)

VASPs have a legal obligation to report suspicious transactions to the FMS without delay.

• Indicators of Suspicion: VASPs must develop systems and training to identify red flags indicative of money laundering, terrorist financing, or other illicit activities. These can include:
  • Unusual or complex transaction patterns.
  • Transactions inconsistent with the customer's known profile.
  • Rapid and inexplicable changes in transaction volume or frequency.
  • Structuring of transactions to avoid thresholds.
  • Transactions involving anonymity-enhancing virtual assets (e.g., privacy coins) without a legitimate explanation.
  • Transactions involving addresses linked to known illicit activities (e.g., darknet markets, scams).
• Reporting Mechanism: Reports are typically submitted electronically to the FMS.
• Prohibition of "Tipping Off": VASPs and their employees are prohibited from disclosing to the customer or any third party that an STR has been filed or that an AML/CFT investigation is underway.

4. Record-Keeping Obligations

VASPs must maintain records for a prescribed period to assist with investigations and provide an audit trail.

• Required Records:
  • All customer identification and verification data (CDD records).
  • Transaction data (including sender and recipient information, amount, type of virtual asset, timestamp, transaction hash).
  • Records of suspicious transaction reports filed.
  • Records of internal risk assessments and compliance policies.
• Retention Period: Records must typically be retained for at least five (5) years after the business relationship has ended or the transaction has been completed.
• Accessibility: Records must be readily available to the FMS or other competent authorities upon request.

5. Internal Controls and Compliance Programs

VASPs are required to establish and maintain robust internal AML/CFT programs, including:

• Risk Assessments: Conducting regular institutional risk assessments to identify and evaluate money laundering and terrorist financing risks, and implementing appropriate mitigation measures.
• Designated Compliance Officer: Appointing a qualified AML Compliance Officer responsible for overseeing the AML/CFT program.
• Employee Training: Providing ongoing training to all relevant employees on AML/CFT policies, procedures, and emerging risks.
• Independent Audit Function: Establishing an independent audit function to test the effectiveness of the AML/CFT program.
• Sanctions Compliance: Screening customers and transactions against national and international sanctions lists.
• Travel Rule: In line with FATF guidance, VASPs are increasingly expected to implement the "Travel Rule," requiring them to obtain and transmit originator and beneficiary information for virtual asset transfers above a certain threshold (typically USD/EUR 1,000).

Conclusion

While Azerbaijan's regulatory framework for virtual assets is still developing, the FMS expects VASPs to comply with the existing AML/CFT Law, aligning with international FATF standards. This means applying the same stringent AML/KYC obligations to virtual asset activities as to traditional financial services. Non-compliance can lead to significant penalties, including fines and potential operational restrictions. VASPs looking to operate in Azerbaijan should seek local legal counsel to ensure full compliance with the evolving regulatory landscape.