Burundi -- AML/CFT Compliance Regulatory Overview

Burundi's regulatory landscape for cryptocurrencies and Virtual Asset Service Providers (VASPs) is still developing and largely aligns with its general anti-money laundering and combating the financing of terrorism (AML/CFT) framework. It's crucial to note that Burundi has historically maintained a cautious, if not restrictive, stance on cryptocurrencies, with the central bank issuing warnings.

As of now, there isn't a comprehensive, dedicated legal framework specifically regulating VASPs in Burundi in the same way traditional financial institutions are regulated. However, general AML/CFT laws, which are largely based on the Financial Action Task Force (FATF) recommendations, would apply to any virtual asset activities that are permitted or tolerated, by extension or analogy. Operating as a VASP in Burundi without explicit regulatory approval could entail significant legal and operational risks.

Here’s an overview based on the existing AML/CFT framework, applied to VASPs by extrapolation:

AML/CFT Requirements for Cryptocurrency/Virtual Asset Service Providers in Burundi

1. AML/CFT Legislation

The primary legislation governing AML/CFT in Burundi is:

• Law N°1/01 of 04 January 2011 on Anti-Money Laundering and Combating the Financing of Terrorism. This law, along with its implementing decrees and ordinances, establishes the general framework for identifying, reporting, and prosecuting money laundering and terrorist financing activities.
• Subsequent Amendments and Regulations: The law is subject to updates and specific regulations issued by relevant authorities, primarily the Financial Intelligence Unit (FIU) and the Central Bank.

Note: This general law does not explicitly mention "virtual assets" or "cryptocurrencies" but applies to "obliged entities" (financial institutions and certain Designated Non-Financial Businesses and Professions - DNFBPs) that process financial transactions, which would include VASP-like activities if they were recognized.

2. Customer Due Diligence (CDD) Requirements

Obliged entities (which would include VASPs if they were formally recognized) are required to implement robust CDD measures, consistent with FATF Recommendation 10, including:

• Identification and Verification:
  • For Individuals: Obtaining and verifying the identity of the customer and any beneficial owner using reliable, independent source documents, data, or information (e.g., national ID cards, passports, utility bills for address verification).
  • For Legal Entities: Obtaining and verifying the legal name, form, proof of existence, powers that regulate and bind the entity, and the identity of the natural persons who are beneficial owners.
• Understanding the Business Relationship: Obtaining information on the purpose and intended nature of the business relationship.
• Ongoing Monitoring: Conducting ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the obliged entity's knowledge of the customer, their business, and risk profile.
• Risk-Based Approach: Applying a risk-based approach, meaning:
  • Simplified CDD (SCDD): Allowed for lower-risk customers, products, or transactions.
  • Enhanced CDD (ECDD): Required for higher-risk situations, such as:
    • Politically Exposed Persons (PEPs)
    • Customers from high-risk jurisdictions
    • Unusual or complex transactions
    • Large value transactions (thresholds would be defined in specific regulations)
    • Transactions involving new technologies or anonymous transactions where the risks are not mitigated.
• Specific VASP Considerations (by analogy with FATF Recommendation 15): If VASPs were formally regulated, CDD would also likely include:
  • Source of funds/wealth verification for significant transactions.
  • Screening customers against sanctions lists and watchlists.
  • Obtaining information on the sender and recipient of virtual asset transfers (Travel Rule equivalent for unhosted wallets, though this is difficult to implement without explicit regulation).

3. Suspicious Transaction Reporting (STR)

Obliged entities have a legal obligation to report any suspicious transactions to the Financial Intelligence Unit (FIU).

• Reporting Thresholds: While specific thresholds might exist for certain fiat transactions, the primary obligation is to report any transaction (regardless of amount) that is suspected of being related to money laundering or terrorist financing.
• Content of Report: Reports must contain all relevant information about the customer, the transaction, and the grounds for suspicion.
• No Tipping-Off: Obliged entities, their directors, officers, and employees are prohibited from disclosing to the customer or any third party that a STR has been or will be submitted.

4. Record-Keeping Obligations

Obliged entities are required to maintain records for a specified period to facilitate any future investigation or analysis.

• Types of Records:
  • Copies of identification documents obtained during CDD.
  • Account files, business correspondence, and transaction data.
  • Records of suspicious transaction reports submitted.
• Retention Period: Records must typically be kept for a minimum period of five (5) years after the business relationship ends or after the date of the occasional transaction.

5. Authority Overseeing Compliance

The primary authority responsible for overseeing AML/CFT compliance in Burundi is:

• Cellule Nationale de Traitement des Informations Financières (CENTIF) – Burundi's Financial Intelligence Unit (FIU)
  • CENTIF is the central national authority responsible for receiving, analyzing, and disseminating suspicious transaction reports to law enforcement agencies for investigation and prosecution. It also plays a role in developing AML/CFT policies and guidelines.
  • URL: http://www.centif.bi/ (Note: Website availability and content can vary over time).

Other relevant bodies include:

• Banque de la République du Burundi (BRB) – The Central Bank of Burundi:
  • The BRB regulates traditional financial institutions and has issued warnings regarding the risks associated with cryptocurrencies. It plays a policy-setting role and would likely be involved in any future regulation of VASPs.
  • URL: https://www.brb.bi/

Important Considerations for VASPs in Burundi:

1. Regulatory Ambiguity and Risk: Given the lack of specific VASP regulation and the central bank's cautionary stance, operating a cryptocurrency service in Burundi could be deemed operating without proper authorization or even be subject to bans.
2. FATF Standards: While Burundi's laws don't explicitly mention VASPs, the country is a member of the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), a FATF-style regional body. This means it is expected to implement FATF recommendations, including Recommendation 15 on virtual assets. Future legislation is likely to align with these global standards.
3. Local Legal Counsel: Any entity considering providing VASP services in Burundi should seek urgent advice from local legal counsel specializing in financial services and AML/CFT to understand the current legal status, potential risks, and any implicit obligations under existing laws.

The situation is dynamic, and regulatory frameworks for virtual assets are evolving globally. It is essential to stay updated on any new laws or directives from Burundian authorities.