Qatar -- AML/CFT Compliance Regulatory Overview

Qatar has significantly strengthened its Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT) framework in line with international standards set by the Financial Action Task Force (FATF). While specific "VASP-only" legislation is still evolving in many jurisdictions, Qatar has taken steps to bring Virtual Asset Service Providers (VASPs) under its existing AML/CFT regime, treating them similarly to traditional financial institutions for compliance purposes. The Qatar Financial Centre (QFC) has been particularly proactive in establishing a regulatory framework for virtual assets within its jurisdiction.

Here's a breakdown of the AML/KYC requirements for cryptocurrency/virtual asset service providers in Qatar:

AML/CFT Legislation

The primary AML/CFT legislation in Qatar, which applies to VASPs by extension and interpretation, is:

1. Law No. (20) of 2019 on Combating Money Laundering and Terrorist Financing: This is the foundational law establishing the AML/CFT framework, defining offenses, obligations for reporting entities, and the powers of regulatory and law enforcement bodies. It aligns Qatar's framework with the latest FATF Recommendations.
2. QCB Regulations and Circulars: The Qatar Central Bank (QCB) issues various circulars and directives that supplement Law No. 20 of 2019, providing detailed guidance on its implementation. While there might not be a single "VASP-specific" circular outside the QFC, the general AML/CFT directives apply to entities dealing with virtual assets.
3. Qatar Financial Centre Regulatory Authority (QFCRA) Rulebook: For entities licensed within the Qatar Financial Centre (QFC), the QFCRA Rulebook, particularly its AML/CFT Rulebook, provides specific and comprehensive requirements. The QFC has been more explicit in classifying and regulating virtual asset activities.

Customer Due Diligence (CDD) Requirements

VASPs in Qatar, like other financial institutions, must adopt a risk-based approach to CDD. Key requirements include:

1. Identification and Verification of Customers:
   • Natural Persons: Obtain and verify the customer's name, permanent address, date of birth, nationality, and official identification document number (e.g., QID, passport).
   • Legal Persons/Arrangements: Obtain and verify the entity's name, legal form, proof of incorporation/establishment, registered address, details of directors/senior management, and the full structure of ownership and control.
2. Beneficial Ownership Identification: Identify and verify the identity of the beneficial owner(s) – any natural person(s) who ultimately own or control 25% or more of the legal person, or on whose behalf a transaction is being conducted.
3. Purpose and Intended Nature of the Business Relationship: Understand the reasons for establishing the relationship and the expected types of transactions.
4. Source of Funds and Source of Wealth: For high-risk customers or transactions, obtain information on the source of funds (where the funds came from for a specific transaction) and the source of wealth (the overall economic activity that generates the customer's total net worth). This is particularly crucial in the virtual asset space.
5. Ongoing Monitoring: Continuously monitor the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes monitoring for unusual or suspicious activities.
6. Politically Exposed Persons (PEPs): Implement procedures to determine if a customer or beneficial owner is a PEP. Apply enhanced due diligence (EDD) measures to PEPs, their family members, and close associates.
7. Sanctions Screening: Screen customers and transactions against national and international sanctions lists (e.g., UNSC sanctions).
8. Enhanced Due Diligence (EDD): Apply EDD for higher-risk scenarios, which often include:
   • Customers from high-risk jurisdictions.
   • Transactions involving complex or opaque structures.
   • Transactions with no apparent economic or lawful purpose.
   • Cross-border virtual asset transfers.
   • New technologies or business practices.
   • Non-face-to-face relationships.

Suspicious Transaction Reporting (STR)

VASPs are considered "reporting entities" under Law No. 20 of 2019. They have a legal obligation to:

• Report Suspicious Activity: Immediately report any transaction, attempted transaction, or funds where there are reasonable grounds to suspect that they are linked to money laundering or terrorist financing.
• No Tipping-Off: Prohibited from disclosing to the customer or any third party that a suspicious transaction report has been filed or that an investigation is underway.
• Reporting Body: All STRs must be submitted to the Qatar Financial Information Unit (QFIU).

Record-Keeping Obligations

VASPs must maintain comprehensive records to support their AML/CFT compliance efforts:

• Customer Identification Data: All records obtained during CDD, including identification documents, verification data, and beneficial ownership information.
• Transaction Records: Records of all domestic and international virtual asset transactions, including dates, amounts, types of assets, sender and receiver details (where available), and relevant transaction hashes.
• Business Correspondence: All correspondence related to customer relationships and transactions.
• Duration: Records must be maintained for a minimum of five (5) years from the date of the transaction or the end of the business relationship, whichever is later.

Authority Overseeing Compliance

The oversight for AML/CFT compliance in Qatar is shared among several key authorities, depending on the VASP's licensing and operational jurisdiction:

1. Qatar Central Bank (QCB):

   • Role: The primary financial regulator responsible for licensing, supervision, and enforcement of AML/CFT regulations for financial institutions operating in Qatar, including VASPs that operate outside the QFC framework.
   • URL: https://www.qcb.gov.qa/

2. Qatar Financial Centre Regulatory Authority (QFCRA):

   • Role: The independent financial regulator for firms operating within the Qatar Financial Centre (QFC). The QFCRA has been proactive in establishing a clear regulatory framework for virtual assets (e.g., through its Virtual Asset Services Rules), making it a key authority for VASPs licensed within the QFC.
   • URL: https://www.qfcra.com/

3. Qatar Financial Information Unit (QFIU):

   • Role: The national central agency responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs) and other financial intelligence related to money laundering and terrorist financing.
   • URL: https://www.qfiu.gov.qa/

4. National Anti-Money Laundering and Terrorist Financing Committee (NAMLC):

   • Role: Chaired by the QCB Governor, this committee coordinates Qatar's national AML/CFT strategy and ensures compliance with international standards.

Important Note: The regulatory landscape for virtual assets is constantly evolving. VASPs operating or intending to operate in Qatar should seek independent legal and regulatory advice to ensure full compliance with the most current requirements. The QFC, in particular, has a more defined framework for virtual asset activities compared to the broader Qatari jurisdiction, where existing financial sector AML/CFT laws are applied.