Uruguay KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Uruguay.
- Dernière revue
- Dernière revue:
- Version
- Version 1.0
Réponse directe
Que couvre la checklist de conformité pour Uruguay ?
La checklist pour Uruguay traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 35 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- National FIU
- Unidad de Información y Análisis Financiero (UIAF) within BCU
- Core AML framework
- Law 19.574, amended by Law 20.469 in March 2026, and Decree 379/018
- Suspicious reports
- Immediately after an operation, completed or attempted, is classified as suspicious
- Beneficial owner
- Natural person with final control; 15% ownership or voting rights is an express limb
- CDD failure
- Do not start or continue; consider or file a ROS as the facts require
- Retention
- At least five years; regulation or sector rules can require up to ten years
- PEP window
- Current and former PEP status remains relevant for at least five years
- Targeted sanctions
- Freeze without delay on applicable list matches and notify UIAF immediately
- Privacy breach
- Notify URCDP within 72 hours after learning of a qualifying security breach
- Virtual assets
- Circular 2507 applications open 1 September 2026; existing PSAVs may apply through 31 March 2027 and continue while processed
- FATF status
- GAFILAT member; not named on FATF public lists reviewed 1 August 2026
Détail d’implémentation
Exigences et actions de conformité pour Uruguay
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities and licensingResolve the exact legal and supervisory perimeter before configuring controls.3 éléments+
Financial obliged subjects fall under Law 19.574 article 12 and BCU/UIAF supervision.
- Action d’implémentation
- Map the legal entity, product and reserved activity to the current BCU compilation and authorization or registration requirement.
- Preuves à conserver
- Perimeter opinion, activity map, authorization, register extract and supervisor matrix.
- Source primaire
- Law 19.574 art. 12
DNFBPs and other non-financial obliged subjects fall under current article 13, as amended by Law 20.469.
- Action d’implémentation
- Test every service against the current list, including professional, real-estate, corporate-service, free-zone and covered support activities; identify SENACLAFT duties.
- Preuves à conserver
- Applicability matrix, service catalogue, customer and transaction nexus, registration and counsel sign-off.
- Source primaire
- Law 19.574 art. 13; Law 20.469 art. 1
A technology or cross-border label does not remove authorization or AML obligations.
- Action d’implémentation
- Assess solicitation, customer location, custody, settlement, issuance, transfer and local operational facts before launch.
- Preuves à conserver
- Product flows, nexus memorandum, geofencing, terms, regulator correspondence and launch gate.
- Source primaire
- Law 19.574 arts. 12-13; applicable BCU rules
02Governance and risk assessmentControls must reflect documented customer, product, channel and geographic risk.3 éléments+
Obliged subjects must conduct and document a risk analysis and apply proportionate policies and procedures.
- Action d’implémentation
- Assess inherent and residual risk, define scoring and overrides and connect results to simplified, standard or enhanced diligence.
- Preuves à conserver
- Enterprise and customer risk methods, data inputs, validation, approvals and change log.
- Source primaire
- Law 19.574 arts. 14-17; Decree 379/018 arts. 5-13
CDD information and risk assessment must remain current throughout the relationship.
- Action d’implémentation
- Set event-driven and risk-based refresh cycles; rescreen and reassess on ownership, activity, product or jurisdiction changes.
- Preuves à conserver
- Refresh policy, trigger events, reviews, screening history, profile changes and exceptions.
- Source primaire
- Law 19.574 arts. 15-16
New products, technologies and delivery methods require risk review before material use.
- Action d’implémentation
- Gate launch through AML, sanctions, privacy, security and licensing review and verify performance after deployment.
- Preuves à conserver
- New-product assessment, scenarios, approvals, test results and post-launch review.
- Source primaire
- Decree 379/018 art. 7; applicable BCU governance rules
03Natural-person KYC and representativesCDD must bind the customer and representative to reliable evidence and the intended relationship.3 éléments+
Identify and verify the customer using reliable documents, data or information.
- Action d’implémentation
- Capture required identity data, authenticate evidence, bind the applicant to it and resolve inconsistencies before activation.
- Preuves à conserver
- Identity record, document images, authenticity and liveness output where used, timestamps and reviewer.
- Source primaire
- Law 19.574 arts. 14-16; Decree 379/018 arts. 7-12
Identify a representative and verify the power to act.
- Action d’implémentation
- Verify the natural person, obtain the current mandate and confirm scope, validity and revocation against reliable evidence.
- Preuves à conserver
- Representative KYC, mandate, registry or notarial check, authority decision and expiry control.
- Source primaire
- Law 19.574 art. 15
If required CDD cannot be completed, do not begin or continue and assess suspicious reporting.
- Action d’implémentation
- Block activation or execution, preserve attempted activity, terminate where required and make a documented ROS decision without tipping off.
- Preuves à conserver
- System block, failure record, termination, escalation, ROS decision and communication log.
- Source primaire
- Law 19.574 art. 16; Decree 379/018 art. 9
04KYB and beneficial ownershipCompany existence, authority, ownership and control must be verified and reconciled.3 éléments+
Legal-person CDD must establish legal existence, structure, purpose, address, managers and authority.
- Action d’implémentation
- Obtain current registry and tax records, constitutional documents, management and signatory evidence and reconcile discrepancies.
- Preuves à conserver
- Registry extract, RUT evidence, statutes, management list, address, signatory proof and discrepancy log.
- Source primaire
- Law 19.574 arts. 14-16; Decree 379/018
Identify the natural person who ultimately owns or controls the customer; 15% capital or voting rights is an express limb.
- Action d’implémentation
- Trace direct and indirect ownership and voting rights, then contractual or de facto control; identify the person on whose behalf funds or activity occur.
- Preuves à conserver
- Ownership chart, percentage calculations, agreements, control memo, declaration and corroboration.
- Source primaire
- Law 19.574 art. 15
Covered entities must report and update beneficial-owner information in the BCU registry under Law 19.484 and its regulations.
- Action d’implémentation
- Determine filing scope, submit current information, report changes within the applicable 30-day or 90-day period and retain supporting records at least five years.
- Preuves à conserver
- Registry filing, receipt, ownership records, change log, deadline control and retention schedule.
- Source primaire
- Law 19.484; Decree 166/017; Decree 43/026
05PEPs, EDD and relianceHigher risk requires added approval, source work and intensified monitoring.3 éléments+
Domestic, foreign and international-organization PEP status remains relevant during office and for at least five years afterward.
- Action d’implémentation
- Screen customers, representatives, beneficial owners, family and close associates and document role, dates and relationship.
- Preuves à conserver
- Screening, role analysis, relationship map, adjudication, approval and review date.
- Source primaire
- Law 19.574 art. 20
High-risk cases require enhanced due diligence, including source and approval measures proportionate to the risk.
- Action d’implémentation
- Obtain senior approval, corroborate source of funds and wealth where applicable and apply intensified monitoring and refresh.
- Preuves à conserver
- EDD memorandum, approval, source evidence, scenario settings, alert history and review.
- Source primaire
- Law 19.574 arts. 18-20; Decree 379/018 art. 13
Simplified diligence is available only in regulated lower-risk cases and never displaces sanctions monitoring or suspicion controls.
- Action d’implémentation
- Define minimum measures and disqualifiers, record the low-risk basis and escalate any contradictory fact.
- Preuves à conserver
- Simplified policy, risk evidence, approval, continuous screening and exceptions.
- Source primaire
- Law 19.574 arts. 17-18, as amended by Law 20.469
06Monitoring and suspicious reportingROS duties are suspicion-based and separate from objective or sector-specific reports.3 éléments+
Monitor activity against the customer profile and examine unusual or complex transactions and attempted transactions.
- Action d’implémentation
- Run risk-calibrated scenarios, investigate promptly, document explanation and source and update risk where facts change.
- Preuves à conserver
- Scenario inventory, alert, transaction trail, investigation, disposition and quality review.
- Source primaire
- Law 19.574 arts. 15-16; Decree 379/018 arts. 7 and 89-90
A suspicious operation report is sent to UIAF immediately once the completed or attempted operation is classified as suspicious.
- Action d’implémentation
- Preserve the decision timestamp, file through the current UIAF channel and retain the report and acknowledgement.
- Preuves à conserver
- Alert, investigation, decision, ROS, submission timestamp, receipt and correction log.
- Source primaire
- Decree 379/018 arts. 89-90; BCU UIAF ROS guidance
Tipping off and unauthorized disclosure of ROS information are prohibited.
- Action d’implémentation
- Restrict case access, separate customer communications from reporting and log every legally authorized disclosure.
- Preuves à conserver
- Access controls, training, communications review, disclosure log and incident record.
- Source primaire
- Law 19.574 arts. 21-23
07Thresholds, transfers and cash controlsThreshold controls depend on activity and sector; there is no universal transaction-report threshold.3 éléments+
CDD applies whenever suspicion or identity doubt exists, regardless of a sector threshold.
- Action d’implémentation
- Configure thresholds only as additional triggers and ensure suspicion, linked operations and evasion attempts override them.
- Preuves à conserver
- Rules inventory, scenario tests, aggregation logic, overrides and alert samples.
- Source primaire
- Decree 379/018 art. 7
Sector and activity thresholds vary; for example, covered art or precious-goods transactions aggregate at USD 15,000 annually under Decree 379/018.
- Action d’implémentation
- Maintain a current activity-specific threshold matrix and do not transplant one sector's amount into another.
- Preuves à conserver
- Legal mapping, threshold table, currency source, system configuration and test cases.
- Source primaire
- Decree 379/018 art. 64 and sector chapters
Persons outside BCU supervision carrying more than USD 10,000 equivalent across the border must follow the applicable declaration regime.
- Action d’implémentation
- Identify relevant cash or bearer-instrument handling, inform affected operations and preserve declarations and escalations.
- Preuves à conserver
- Procedure, declaration, amount and currency record, receipt and incident log.
- Source primaire
- Decree 379/018 art. 100
08Sanctions and targeted financial measuresApplicable list matches require action without delay and immediate UIAF notice.3 éléments+
Law 19.749 requires preventive freezing without delay for applicable United Nations and other covered list matches.
- Action d’implémentation
- Screen at onboarding, on list updates and before execution; validate matches promptly and freeze without advance notice where required.
- Preuves à conserver
- List sources, screening logs, match packet, action timestamp and frozen-assets record.
- Source primaire
- Law 19.749
A freeze and relevant incoming assets must be notified immediately to UIAF for the statutory judicial process.
- Action d’implémentation
- Use the current notification channel, preserve funds as directed and maintain the court and release timeline.
- Preuves à conserver
- UIAF notice, receipt, court record, incoming-funds log, release or continuation instruction.
- Source primaire
- Law 19.749
Sanctions screening must cover customers, beneficial owners, representatives and relevant transaction parties.
- Action d’implémentation
- Map every field and party, test aliases and transliteration and monitor feed and system failures.
- Preuves à conserver
- Coverage map, test cases, alert samples, feed monitoring, incidents and remediation.
- Source primaire
- Law 19.749; Law 19.574 arts. 14-16
09Records, audit and regulator responseRecords must reconstruct the customer, transaction, alert and decision.3 éléments+
CDD and transaction records must be retained at least five years after an occasional transaction or relationship; regulation or sector rules can reach ten years.
- Action d’implémentation
- Apply the longest applicable event-based period, preserve legal holds and test retrieval throughout the lifecycle.
- Preuves à conserver
- Retention matrix, closure event, repository inventory, retrieval test, hold and disposal logs.
- Source primaire
- Law 19.574 art. 21
UIAF, BCU and SENACLAFT can require records within their competence.
- Action d’implémentation
- Authenticate requests, preserve confidentiality and privilege, produce responsive records and track remediation.
- Preuves à conserver
- Request, authority validation, production set, delivery receipt, privilege log and remediation tracker.
- Source primaire
- Law 19.574 arts. 6, 12-13 and 22
Independent review should test control effectiveness and reporting timeliness under the applicable sector rules.
- Action d’implémentation
- Set competence and independence, sample end-to-end cases, validate data lineage and verify corrective-action closure.
- Preuves à conserver
- Audit scope, workpapers, samples, report, actions and closure validation.
- Source primaire
- Applicable BCU compilation or SENACLAFT rule; Law 19.574 arts. 12-16
10Privacy, biometrics and transfersAML processing must also meet Uruguay's proactive privacy-accountability rules.4 éléments+
Law 18.331 requires lawful, purpose-limited, proportionate and secure processing with documented accountability.
- Action d’implémentation
- Map roles, fields, purposes and legal grounds; provide transparency and reconcile data-subject rights with mandatory AML retention and reporting.
- Preuves à conserver
- Data inventory, legal-basis register, notice, request procedure, retention reconciliation and security assessment.
- Source primaire
- Law 18.331 arts. 4-12
Biometric processing is expressly regulated and can require a data-protection impact assessment and privacy-by-design controls.
- Action d’implémentation
- Assess necessity and alternatives before use, complete the required impact analysis, limit templates and access and provide an accessible fallback.
- Preuves à conserver
- DPIA, necessity analysis, architecture, consent or legal ground, retention, access review and fallback test.
- Source primaire
- Law 18.331 arts. 4, 12 and 18 bis; URCDP Resolution 30/020
Notify URCDP within 72 hours after learning of a qualifying breach and notify significantly affected people in clear language.
- Action d’implémentation
- Maintain detection, assessment and notification workflows, record the knowledge time and submit a detailed follow-up after remediation.
- Preuves à conserver
- Incident log, impact analysis, URCDP notice, affected-person notice, timestamps and final report.
- Source primaire
- Decree 64/020 art. 4
International transfers require an adequate destination or a documented statutory route or exception.
- Action d’implémentation
- Map every vendor, group and authority transfer, document the route and safeguards and control onward transfers and deletion.
- Preuves à conserver
- Transfer register, adequacy or exception record, contract, due diligence and deletion proof.
- Source primaire
- Law 18.331 art. 23
11Payments, virtual assets and launch evidencePayment and PSAV permissions are activity-specific and newly time-sensitive.4 éléments+
Electronic-money issuance and other reserved payment activities require BCU authorization or registration as applicable.
- Action d’implémentation
- Classify issuing, acquiring, processing, transfer, wallet and settlement functions against Law 19.210 and the current payment rules before launch.
- Preuves à conserver
- Product flow, perimeter opinion, application, authorization or registration, conditions and register check.
- Source primaire
- Law 19.210 art. 4; BCU Payment System Rules
Law 20.345 brought PSAVs into BCU's perimeter and Circular 2507 establishes prior authorization and operating requirements.
- Action d’implémentation
- Classify exchange, transfer, custody, administration, platform and related services; build the governance, capital, safeguards, conduct, technology and AML application pack.
- Preuves à conserver
- Service classification, application plan, corporate records, control manuals, capital and guarantee evidence, contracts and approvals.
- Source primaire
- Law 20.345; BCU Circular 2507
PSAV applications open 1 September 2026; existing providers may apply through 31 March 2027 and continue while the application is processed.
- Action d’implémentation
- Do not claim present authorization before the window opens; determine existing-provider status, calendar the deadline and control launch or continuity under the transition.
- Preuves à conserver
- Transition memorandum, activity evidence, application calendar, submission receipt when available and regulator correspondence.
- Source primaire
- BCU Circular 2507, transitional provision to art. 127.27
Launch requires source-backed closure and end-to-end dry testing without fictional regulator submissions.
- Action d’implémentation
- Test onboarding, KYB, ROS timing, sanctions, retention, privacy, breach and licensing gates; close blockers and obtain legal, compliance, privacy, security and product sign-off.
- Preuves à conserver
- Completed checklist, source register, tests, defects and closure, approvals and monitoring owner.
- Source primaire
- Law 19.574 arts. 12-23; BCU Circular 2507
Registre des sources primaires
25 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- Law 19.574 - current consolidated AML/CFT textIMPO · Primary legislation
- Law 20.469 of 19 March 2026IMPO · Primary amending legislation
- Decree 379/018 implementing AML dutiesIMPO · Primary regulation
- UIAF suspicious operation reporting guidanceBanco Central del Uruguay · Official reporting guidance
- UIAF Annual Report 2024Banco Central del Uruguay · Official FIU report
- UIAF Circular of 24 April 2026Banco Central del Uruguay · Official current instruction
- Law 19.749 on targeted financial sanctionsIMPO · Primary legislation
- Law 19.484 on fiscal transparency and beneficial ownershipIMPO · Primary legislation
- Decree 166/017 on beneficial-owner reportingIMPO · Primary regulation
- Decree 43/026 updating beneficial-owner rulesIMPO · Primary regulation
- BCU beneficial-owner registry guidanceBanco Central del Uruguay · Official registry guidance
- Law 18.331 on personal dataIMPO · Primary legislation
- Decree 64/020 on privacy accountability and breach responseIMPO · Primary regulation
- URCDP role and authorityUnidad Reguladora y de Control de Datos Personales · Official authority description
- URCDP general personal-data guideUnidad Reguladora y de Control de Datos Personales · Official guidance
- URCDP Resolution 30/020 on biometrics and DPIAsUnidad Reguladora y de Control de Datos Personales · Official regulatory decision
- Law 19.210 on financial inclusion and payment servicesIMPO · Primary legislation
- BCU Payment System RulesBanco Central del Uruguay · Official regulatory directory
- Law 20.345 on virtual assets and PSAVsIMPO · Primary legislation
- BCU Circular 2507 - PSAV regulationBanco Central del Uruguay · Primary regulatory instrument
- BCU announcement of the PSAV rulesBanco Central del Uruguay · Official current announcement
- FATF mutual evaluation of UruguayFinancial Action Task Force · Official international assessment
- FATF jurisdictions under increased monitoring, 19 June 2026Financial Action Task Force · Official current-status source
- FATF high-risk jurisdictions subject to a call for action, 19 June 2026Financial Action Task Force · Official current-status source
- United Nations Security Council Consolidated ListUnited Nations Security Council · Official sanctions list
Réponses directes
Questions KYC, KYB et AML pour Uruguay
Who receives suspicious operation reports?+
The UIAF within Banco Central del Uruguay receives ROS through its current channel. BCU supervises financial subjects; SENACLAFT supervises the non-financial subjects assigned to it.
When is a ROS due?+
Immediately once a completed or attempted operation is classified as suspicious. Preserve the classification time, submission and acknowledgement.
Is there one universal reporting threshold?+
No. Objective and systematic reports are sector- and activity-specific. Suspicion and identity doubt override monetary thresholds.
What beneficial-owner percentage applies?+
Fifteen percent of capital or voting rights is an express limb, but the analysis must also identify control by other means and the person on whose behalf funds or activity occur.
How long are AML records kept?+
At least five years after an occasional transaction or the end of the relationship. Regulation or sector rules can require up to ten years, and legal holds may require longer.
Can onboarding continue if CDD fails?+
No. Do not start or continue the relationship or transaction, preserve the facts and assess or file a ROS as required without tipping off.
What is the privacy breach deadline?+
A qualifying breach must be reported to URCDP within 72 hours after it becomes known. Significantly affected people must also receive clear notice, followed by a detailed report after remediation.
Are PSAVs already able to apply under Circular 2507?+
Applications open on 1 September 2026. Existing providers have through 31 March 2027 to apply and may continue while the application is processed. New providers should not operate before obtaining the required authorization.
Does a payment registration cover virtual-asset services?+
No. Classify payment and PSAV functions separately. Law 20.345 and Circular 2507 create a distinct BCU authorization framework for covered virtual-asset services.
Is Uruguay on a FATF public list?+
Uruguay was not named on the FATF increased-monitoring or call-for-action lists dated 19 June 2026 and reviewed 1 August 2026. It is a GAFILAT member and its evaluation history remains relevant.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General regulatory information, not legal advice, an authorization decision or a substitute for the operative Spanish text, current BCU compilations, UIAF instructions, SENACLAFT rules or official forms. Reviewed 1 August 2026. Uruguay amended its AML law in March 2026 and adopted PSAV rules in July 2026; confirm commencement, transition, entity, activity, threshold, reporting channel and later developments with qualified Uruguayan counsel and the competent authority before launch.