BCEAO KYC requirements: what WAEMU financial institutions must check

The reference texts

Both instructions apply to credit institutions, financial holding companies, microfinance institutions, e-money and payment institutions, fintechs and licensed manual exchange dealers, including operations by their intermediaries, sub-agents and distributors.

• Directive No. 01/2023/CM/UEMOA of 31 March 2023 and the March 2023 AML/CFT/PF uniform law, which each state transposes. It replaces the 2015 framework and adds the financing of proliferation of weapons of mass destruction.
• In Côte d’Ivoire, the uniform law was transposed by Ordinance No. 2023-875 of 23 November 2023.
• BCEAO Instruction No. 001-03-2025 of 18 March 2025: organisation, internal control and AML/CFT/PF compliance.
• BCEAO Instruction No. 003-03-2025 of March 2025: identification, identity verification and knowledge of customers.

Identifying and verifying an individual

Verification happens before the relationship starts. The uniform law allows it to be completed afterwards, as soon as possible and at the latest before the first transaction, if this is essential to avoid interrupting business and the risks are managed.

• Collect the full name, date and place of birth, nationality, address and ID document number.
• Verify identity on the original of a valid official photo document issued by a public authority: passport, ID card, driving licence, residence permit or consular card, combining several documents if needed.
• Prove the address, for example with a utility bill or a lease with the landlord’s attestation; these documents are less than three months old, except the lease.
• Know the customer: occupation or business, financial situation and links with third parties involved in the relationship.

Identifying a company and its beneficial owners

• Collect the company name, legal form, directors, shareholders or partners, authorised representatives, registered office, beneficial owners and the RCCM or tax number.
• Verify them on an official register extract less than three months old, an Official Journal extract and the representatives’ ID documents.
• A beneficial owner is any natural person who holds, directly or indirectly, more than 25% of the capital or voting rights, or controls the company by any other means. Failing that, the senior managing official is identified.
• Keep an internal beneficial ownership file and check the customer’s list against the national beneficial ownership register; report any discrepancy to the authority that keeps it.

Politically exposed persons (PEPs)

The uniform law covers foreign PEPs, domestic PEPs and PEPs of international organisations, as well as their family members and close associates.

• Formal procedures to determine whether a customer or beneficial owner is a PEP.
• Senior management approval before entering the relationship; senior management also approves the list of PEP customers.
• Establishing the source of wealth and funds, and enhanced monitoring.
• PEP customer profiles are reassessed every three years.

Due diligence proportionate to risk

Each business relationship is rated with the risk factors in Annex 1 of Instruction No. 003-03-2025 (customer, country, products, channels), including the FATF lists and United Nations sanctions. The rating is documented and must be justifiable to the BCEAO or the Banking Commission.

Simplified due diligence is possible when the risk is low, but stops as soon as there is a suspicion. Enhanced due diligence is mandatory when the risk is high, for a large or unusual transaction, or when information is insufficient or inconsistent: extra documents, checking document authenticity, source of funds, a senior management decision.

Targeted financial sanctions

Once a list of persons linked to terrorist or proliferation financing is notified, the institution freezes their assets immediately, without warning them, and informs the CENTIF. Instruction No. 001-03-2025 requires the information system to apply list changes “without delay”, defined as within twenty-four hours at most.

Remote onboarding

Instruction No. 003-03-2025 allows remote identification and verification, at the institution’s own responsibility, using reliable electronic identification means and the same requirements as for a customer who is present.

• The solution must compare the customer’s physical features with those on the documents provided; biometric data must be unambiguously linked to the customer.
• If the quality of the evidence leaves doubt, the customer is sent to an in-person check.
• An internal control ensures that the first transaction happens only after the identity of the customer and, where relevant, the beneficial owner has been verified.
• Procedures describe the customer journey, authentication, data retention, cybersecurity and personal data protection.
• The institution may use a provider for verification, at its own responsibility, making sure the provider applies its procedures and has the necessary means.

Ongoing monitoring, updates and record keeping

• Transactions are reviewed to check they are consistent with what the institution knows about the customer and the source of funds.
• The KYC file is updated periodically, and always after a significant event: a new beneficial owner, a new product, anything that changes the risk profile.
• Identity documents and due diligence analyses are kept for ten years after the account closes or the relationship ends; transaction records for ten years after execution.

Suspicious transaction reports

The institution immediately reports to its national CENTIF any funds or transaction, even attempted, that it suspects derive from money laundering, terrorist or proliferation financing. If it cannot complete its due diligence, it does not open the account or ends the relationship, and reports in every case. Telling the customer about the report is prohibited.

What Verita automates

Verita provides the tooling; as the texts state, responsibility for due diligence stays with the institution.

• Reading and checking identity documents, comparing the face with the document photo and liveness, for remote onboarding.
• When a photo or document is too poor to judge, the file goes to human review instead of being decided blindly.
• Sanctions and PEP screening, with lists refreshed every day, for the customer and each of its beneficial owners.
• For Ivorian companies, reading the RCCM and cross-checking it with CEPICI sources.
• A hash-chained audit trail and readable reasoning behind each decision, to justify the rating to the BCEAO or the Banking Commission.
• Suspicious transaction reports prepared and approved by two people, in the format of Côte d’Ivoire’s CENTIF.