meta_id 3417596

The Maldives Monetary Authority (MMA) issued the Regulation on Simplified and Electronic Customer Due Diligence pursuant to the Prevention of Money Laundering and Financing of Terrorism Act (Law No. 10/2014) . The regulation comes into force upon publication in the Government Gazette and establishes minimum requirements and standards for reporting entities conducting customer identification and verification through simplified due diligence (SDD) and electronic customer due diligence (Electronic CDD) methods. The regulation applies to banks, financing companies, payment service providers offering account information, electronic money issuance, payment initiation, payment transaction acquisition, and remittance services. It also covers insurance companies and intermediaries engaged in life insurance and family takaful businesses, as well as capital market entities licensed under the Maldives Securities Act and designated non-financial businesses and professions. Highlights of the regulation are: Reporting entities must adopt a risk-based approach, with boards of directors or responsible persons ensuring effective implementation of policies addressing operational, customer information, information technology, and money laundering and terrorism financing risks. Prior to applying SDD or Electronic CDD methods, entities must conduct documented risk assessments considering customer politically exposed person (PEP) status, sanctions status, products, services, delivery channels, geographic factors, and transaction-related risks. The regulation permits Electronic CDD methods including video identification, government system verification, reliance on licensed banks under written agreement, and biometric authentication linked to government systems. Video identification must employ active liveness detection technology capable of detecting deepfakes, presentation attacks, and injection attacks, with false acceptance rates meeting authority-specified thresholds. Reporting entities must retain identification records, one-time password logs, biometric session outputs, full video recordings, screenshots, consent records, and metadata for a minimum of five years. Customers must receive clear information about identification procedures and provide explicit consent for ancillary processing involving biometric data collection. Reporting entities must achieve full compliance within three months from the regulation's commencement date. Entities already operating Electronic CDD procedures must review and update them within six months to align with the regulation's specific requirements, including video call standards and video recording retention standards. All entities must update internal anti-money laundering and counter-terrorism financing policies, risk assessment frameworks, and training materials within three months regardless of current implementation status.