AML and KYC Due Diligence Requirements in Oman: Business Compliance Guide

A real estate agency in Muscat completes a high-value property sale without properly verifying the buyer’s identity or checking the source of funds. Months later, regulators ask the business to provide customer records, transaction details, and evidence of its due diligence checks. The team cannot produce a complete file.

This situation exposes a serious compliance gap. In Oman, anti-money laundering (AML) and know-your-customer (KYC) procedures help businesses identify customers, understand transactions, and detect suspicious activity before it creates greater risks.

Under Royal Decree 30/2016, Oman’s Law on Combating Money Laundering and Terrorism Financing, applicable financial institutions and designated non-financial businesses and professions must follow the relevant preventive and reporting obligations. The precise requirements depend on the business activity and applicable supervisory rules.

This guide explains AML and KYC due diligence requirements in Oman, the documents businesses need, when to conduct enhanced checks, and the practical steps to establish an effective compliance program.

Which Laws Govern AML and KYC Requirements in Oman?

Oman’s AML framework combines national legislation with regulations and instructions issued by the relevant supervisory authorities. Businesses need to identify the rules that apply to their activities rather than rely on a general checklist.

Royal Decree 30/2016

The Law on Combating Money Laundering and Terrorism Financing, issued under Royal Decree 30/2016, establishes the national legal framework for preventing and addressing money laundering and terrorism financing.

The law covers relevant customer due diligence, record-keeping, internal controls, suspicious transaction reporting, and penalties for violations. It also defines the responsibilities of the National Centre for Financial Information (NCFI) and the competent supervisory authorities.

Businesses should review the law alongside applicable executive regulations and sector-specific instructions.

Central Bank of Oman Requirements

The Central Bank of Oman (CBO) supervises licensed financial institutions, including banks and other institutions within its regulatory scope. Its AML/CFT instructions establish requirements for customer verification, risk assessment, transaction monitoring, compliance arrangements, record retention, and staff training.

Financial institutions must apply the requirements relevant to their licence and activities. Businesses outside the CBO’s supervisory scope should consult their own regulator rather than assume that banking rules apply to them in exactly the same way.

Financial Services Authority Requirements

The Financial Services Authority (FSA) oversees relevant insurance, capital markets, and other financial activities within its jurisdiction. Its published AML/CFT regulations include instructions for insurance and takaful businesses, brokers, agents, and capital market institutions.

These requirements address customer risk, geographical exposure, products, services, transaction patterns and delivery channels. Businesses in regulated financial sectors should follow the instructions that apply to their specific activities.

National Center for Financial Information

The NCFI serves as Oman’s financial intelligence unit. It receives and analyses suspicious transaction reports and supports investigations into suspected financial crime.

Businesses subject to reporting obligations must follow the applicable reporting procedures and escalation requirements. They should also ensure that employees know how to raise concerns internally without alerting the customer to a suspicious transaction report.

The Central Bank of Oman and the Financial Services Authority provide official legal and regulatory references.

Which Businesses Must Follow AML and KYC Requirements in Oman?

AML obligations are not limited to banks. Oman’s legal framework also covers relevant non-financial businesses and professions, with specific requirements depending on the activity and applicable regulations.

Businesses that need to assess their obligations include:

• Banks and financial institutions: Banks and other institutions within the scope of financial sector AML regulations.
• Insurance and capital market businesses: Insurers, takaful operators, relevant intermediaries, brokers, and investment businesses subject to the applicable rules.
• Money exchange and remittance providers: Businesses conducting regulated money transfer or exchange activities.
• Real estate businesses: Relevant agents and other covered businesses involved in property transactions.
• Precious metals and stones dealers: Businesses covered by the applicable AML regulations for high-value goods.
• Accounting and auditing practices: Firms whose activities fall within the relevant designated-profession requirements.
• Other covered businesses and professions: Additional entities identified by the law, implementing regulations or competent supervisory authorities.

What Does Customer Due Diligence Mean for Businesses in Oman?

Customer due diligence (CDD) is the process of identifying customers, verifying their identities, understanding the purpose of a business relationship, and assessing the associated risks.

CDD is not limited to collecting identification documents when a customer first approaches a business. Where applicable, it also involves reviewing customer information, understanding ownership structures, and monitoring activity throughout the relationship.

Identify and Verify the Customer

Businesses need reliable information to establish who they are dealing with. The documents and verification methods depend on the customer type, transaction, and applicable requirements.

For an individual, the process may involve a civil ID or passport, relevant residency information, and other identifying details. For a company, it may involve commercial registration documents, licensing information, constitutional documents, and details of authorised representatives.

Collecting a document is only one part of verification. Staff must check that the information is credible, consistent, and sufficient under the applicable rules.

Identify the Beneficial Owner

A beneficial owner is the natural person who ultimately owns or controls a customer, whether directly or indirectly.

For corporate customers, checking only the commercial registration or the name of the immediate shareholder does not always reveal who controls the business. Staff may need to examine ownership chains, voting rights, and other arrangements that establish effective control.

Oman’s Ministerial Decision 424/2023 sets out rules for identifying and registering beneficial owners. The regulation also addresses updating beneficial ownership information and maintaining the relevant register.

Businesses must distinguish their obligations under the beneficial ownership registration rules from any additional beneficial ownership checks required under their AML regulations. Verify the applicable definition and identification criteria before setting a fixed ownership threshold in an internal checklist.

Understand the Purpose of the Relationship

Businesses need to understand why a customer wants a particular service and whether the proposed activity fits the customer’s known profile.

For example, a newly established trading company requesting assistance with unusually large international transfers may need additional questions about its operations, counterparties, and source of funds.

Document the explanation and supporting evidence where required. If the customer’s stated purpose does not match the transaction, escalate the concern under the business’s procedures.

Monitor Customers and Transactions

CDD continues after onboarding. Businesses subject to ongoing monitoring requirements must review activity against the information they hold about the customer.

Sudden changes in transaction size, unexplained transfers, unusual cash activity, or changes in ownership can justify further checks. Customer information should also be updated when circumstances change and at intervals determined by the applicable rules and risk assessment.

When Is Enhanced Due Diligence Required in Oman?

Enhanced due diligence (EDD) involves additional checks for customers, transactions, or business relationships that present higher money laundering or terrorism financing risks.

Relevant risk factors can include:

• Politically exposed persons (PEPs): Customers or beneficial owners whose public positions create additional corruption or financial crime risks, together with relevant family members and close associates where the rules apply.
• High-risk geographical exposure: Customers, counterparties, or transactions connected to jurisdictions identified as high risk under applicable requirements.
• Complex ownership structures: Multiple layers of companies, unexplained offshore entities, or arrangements that make the ultimate owner difficult to identify.
• Unusual transactions: Activity that does not fit the customer’s business profile or has no clear economic purpose.
• Higher-risk delivery channels: Relationships involving remote onboarding or other circumstances that increase identity verification risks.

Depending on the applicable rules, EDD can include obtaining additional customer information, establishing the source of funds or source of wealth, obtaining senior management approval, and increasing the frequency of monitoring.

Which KYC Documents Do Businesses in Oman Need?

The exact documentation depends on the customer, business activity, and applicable regulatory requirements. A practical checklist can include the following.

How Does Sanctions Screening Support AML Compliance?

Sanctions screening helps businesses identify customers, beneficial owners, and relevant counterparties who appear on applicable sanctions lists.

A name match does not automatically establish that two records refer to the same person. Staff need a documented process to check identifying details, resolve potential matches, and escalate confirmed or unresolved concerns.

Where required, screening should take place during onboarding and at appropriate points throughout the relationship. Changes in ownership, customer information, or relevant sanctions designations may require further checks.

Businesses must follow the sanctions measures and screening obligations applicable to their activities. Screening should be part of a broader risk-based compliance program, not an isolated database check.

How Should Businesses Report Suspicious Transactions to the NCFI?

Businesses subject to suspicious transaction reporting obligations must report when the applicable legal threshold is met. Staff should not wait for proof of a crime before escalating a genuine suspicion.

Potential warning signs include unexplained transfers, transactions inconsistent with the customer’s known activities, attempts to conceal beneficial ownership, and repeated transactions with no clear commercial explanation.

An effective reporting process should include:

1. Recognising the concern: Employees identify unusual activity and follow the internal escalation procedure.
2. Reviewing the available information: The responsible compliance personnel assess the facts and supporting records.
3. Making the reporting decision: The authorised person follows the applicable reporting rules and procedures.
4. Submitting the report: Reports are sent through the appropriate NCFI reporting channel in accordance with the applicable requirements.
5. Maintaining confidentiality: Staff protect the report and related information and avoid prohibited disclosure to the customer.

Businesses must also follow applicable tipping-off restrictions. Informing a customer that a suspicious transaction report has been filed, or disclosing related information where prohibited, can create additional legal exposure.

What Record-Keeping and Internal Controls Are Required?

A business needs evidence that its compliance procedures operate in practice. Written policies alone are insufficient if employees cannot follow them or produce the relevant records when requested.

Maintain Customer and Transaction Records

Keep the customer identification documents, verification results, beneficial ownership information, transaction records, and relevant correspondence required by the applicable rules.

Some Omani AML regulations require retaining certain records for at least ten years. The starting point and scope of retention can differ by provision and sector. Businesses should confirm the relevant period rather than apply one general rule to every record.

Establish Written AML Procedures

Document how the business identifies customers, assesses risk, conducts enhanced checks, monitors activity, escalates concerns, and reports suspicious transactions.

The procedures should identify the employees responsible for each stage and explain how exceptions are handled.

Assign Compliance Responsibilities

Senior management should oversee the compliance framework and approve the policies where required. The designated compliance officer or MLRO, where applicable, should manage the responsibilities assigned by the relevant regulations.

Frontline employees also play an important role. They must recognize warning signs, complete required checks, and raise concerns through the correct channels.

Train Employees and Review Controls

Provide appropriate training when employees join and refresh it regularly. Training should reflect the risks associated with their roles and include practical examples of suspicious activity and escalation procedures.

Periodic internal or independent reviews help identify incomplete customer files, outdated information, and monitoring weaknesses. Businesses should record findings, assign corrective actions, and verify completion.

What Are the Penalties for AML Non-Compliance in Oman?

Breaches of AML requirements can result in criminal penalties, regulatory sanctions, and commercial consequences. The nature and severity of the outcome depend on the offence, the applicable legal provision, and the circumstances of the breach.

Potential consequences include:

• Criminal prosecution for offenses covered by the AML/CFT law.
• Administrative penalties or other regulatory action for failures to meet applicable preventive obligations.
• Restrictions on regulated activities or licensing consequences, where authorised by the relevant framework.
• Damage to business relationships, reputation, and access to financial services.

Beneficial ownership registration failures can also create separate compliance issues. For example, Ministerial Decision 424/2023 requires updating beneficial ownership information within five working days of a change, along with related record-keeping and information obligations.

Businesses should verify the specific penalty and legal provision before quoting a monetary amount. A figure associated with one reporting duty or registration failure must not be presented as the maximum penalty for all AML violations.

How Can a Business Build an Effective AML and KYC Process?

A structured approach helps businesses turn regulatory requirements into repeatable daily procedures.

Step 1: Identify the Applicable Rules

Determine which laws, licensing conditions and supervisory instructions apply to the business. Record the relevant reporting obligations, documentation requirements and retention periods.

Step 2: Assess Money Laundering Risks

Evaluate customer types, geographical exposure, products, services, transactions and delivery channels. Document the factors that influence the risk rating and review the assessment when the business or its exposure changes.

Step 3: Develop Policies and Checklists

Prepare practical procedures for customer onboarding, identity verification, beneficial ownership checks, sanctions screening, enhanced due diligence and transaction monitoring. Assign responsibility for approvals and escalation.

Step 4: Complete Due Diligence Before Proceeding

Collect and verify the required information before establishing a relationship or completing a transaction when the applicable rules require it. Escalate missing information, inconsistencies and unresolved risk indicators.

Step 5: Monitor and Update Customer Information

Apply ongoing monitoring and review schedules that reflect the customer’s risk level and the relevant regulatory requirements. Update information when ownership, activity or other material circumstances change.

Step 6: Test the Programme and Correct Gaps

Review a sample of customer files, transaction records and screening results. Check whether employees followed the procedures, records support the decisions made and reporting concerns were escalated appropriately.

Assign corrective actions to named individuals and set deadlines for completion. Repeat the review to confirm that the identified weaknesses have been addressed.

Common AML and KYC Mistakes Businesses Should Avoid

Several practical failures can weaken an otherwise well-designed compliance programme.

Checking only the immediate shareholder: Businesses can miss the person who ultimately owns or controls a corporate customer. Review ownership structures and identify the relevant natural persons.

Treating onboarding as a one-time exercise: Customer details and risk profiles change. Apply the required monitoring and update procedures throughout the relationship.

Using the same checks for every customer: A uniform process can overlook higher-risk situations. Apply the level of due diligence required by the customer’s risk profile and the applicable rules.

Ignoring sanctions screening alerts: An unresolved potential match should follow a documented review and escalation process rather than be dismissed without evidence.

Keeping incomplete or scattered records: Information spread across personal devices, email accounts, and paper files can be difficult to retrieve. Use secure, controlled record management with appropriate access and audit trails.

Providing training without testing understanding: Attendance records alone don’t show that employees understand their duties. Use practical scenarios and periodic reviews to test whether staff follow the procedures.

Get Support with AML and KYC Requirements in Oman 

AML and KYC due diligence in Oman involves more than collecting identification documents. Businesses must identify the rules that apply to their activities, verify customers and beneficial owners, assess risks, monitor transactions, and maintain records that demonstrate compliance.

A documented process helps employees apply the required checks consistently and address gaps before they become more serious problems. Regular reviews, appropriate training, and clear reporting procedures also help businesses respond to changing risks and regulatory expectations.

MFN Auditing supports businesses with relevant audit and compliance services, including AML and KYC procedure reviews, customer file assessments, and staff training, where these services fall within the agreed engagement. Businesses can contact the team to discuss their requirements and determine the appropriate scope of support.

Frequently Asked Questions

Do small businesses in Oman need to follow AML and KYC rules?

Small businesses must comply when their activities fall within the applicable AML/CFT framework. Their obligations depend on the business type, applicable legal requirements, and any sector-specific regulations. Business size alone does not establish an exemption.

What is the beneficial ownership threshold in Oman?

The relevant criteria depend on the applicable beneficial ownership rules and AML requirements. Businesses should identify the natural persons who ultimately own or control a customer and verify the applicable registration and due diligence criteria rather than rely on an ownership percentage alone.

Where should businesses report suspicious transactions in Oman?

Businesses subject to reporting obligations must follow the prescribed reporting process through the National Center for Financial Information (NCFI). They should maintain confidentiality and comply with applicable restrictions on tipping off.

How long must AML and KYC records be retained?

Some Omani AML regulations require retaining specified customer due diligence and transaction records for at least ten years. Businesses should confirm the precise retention period and when it begins under the rules governing their activities.

Is sanctions screening part of KYC?

Sanctions screening supports customer and beneficial ownership checks where applicable. Businesses should use the relevant lists and screening requirements for their activities, document potential matches, and follow the prescribed escalation process.

Can a business outsource AML and KYC compliance?

External specialists can support activities such as policy development, staff training, file reviews and compliance assessments. However, outsourcing does not automatically remove the business’s own legal responsibilities. Any arrangement must comply with applicable rules, including requirements governing accountability, access to records, and reliance on third parties.