Key Takeaways
- Vanuatu's AML and CTF framework sets out who qualifies as a reporting entity and the customer due diligence each must perform.
- Foreign-owned companies should understand enhanced due diligence for PEPs, a risk-based approach, and ongoing monitoring of business relationships.
- Record-keeping and suspicious activity reporting to the Vanuatu Financial Intelligence Unit are core duties supervised alongside the VFSC.
- Registered agents play a central compliance role, and breaches of the AML obligations can trigger penalties and enforcement action.
AML and KYC Obligations in Vanuatu: An Overview
Anti-money laundering and know-your-customer rules in Vanuatu are a live obligation, not a formality. The framework rests on the Anti-Money Laundering and Counter-Terrorism Financing Act No. 13 of 2014, which classifies a wide range of businesses as "reporting entities" and requires them to verify customers, monitor transactions, keep records, and report suspicious activity. Oversight sits with the Vanuatu Financial Intelligence Unit and the Vanuatu Financial Services Commission, with banks supervised by the Reserve Bank.
This article explains how the AML/KYC regime works in practice for a foreign-owned company: which entities are caught, what due diligence applies, how records and reports must be handled, and what happens when obligations are missed. It is most relevant to non-resident owners of International Companies and to financial-services or fiduciary businesses operating through a licensed local agent.
The Vanuatu AML Legal Framework: The AML and CTF Act 2014 and Its Regulations
The governing statute came into effect on 24 June 2014, replacing the older Financial Transaction Reporting Act that had operated since 2000. It sets the preventive measures every reporting entity must implement and remains the reference point for compliance, now cited in its consolidated form as amended in 2023.
Detail lives in the subordinate rules. AML&CTF Regulation Order No. 122 of 2014 spells out customer due diligence procedures, the documents accepted for verification, and the prescribed report templates; it was amended by Regulation Amendment Order No. 2 of 2015 and later orders.
Parallel reforms in January 2015 amended the Proceeds of Crime Act and the Counter Terrorism and Transnational and Organized Crime Act, broadening the criminal-law backing for the regime. More recently, the Virtual Assets Service Providers Act 2025 extended oversight to digital-asset businesses.
The jurisdiction's standing improved markedly over the past decade. After exiting the FATF grey list in 2018, the territory was rated Compliant on 18 and Largely Compliant on 19 of the FATF 40 Recommendations in its follow-up evaluation.
The consolidated AML&CTF Act and the regulation templates are published on the VFIU site at fiu.gov.vu; a copy of the Act is also hosted by the Reserve Bank. These are the authoritative texts for any compliance question.
Company Incorporation in Vanuatu
Set up your company in Vanuatu with Expanship handling registration end to end.
The AML Supervisor: The Vanuatu Financial Intelligence Unit and the VFSC
The VFIU was established in September 2000 and operates as a unit within the State Law Office, based in the Prime Minister's Complex next to the Reserve Bank. It gathers, analyses, and disseminates financial intelligence to support the detection and prosecution of money laundering, terrorism financing, and related crime.
Its powers go beyond intelligence. VFIU officers conduct compliance examinations of reporting entities and issue compliance directions, often jointly with staff from the Reserve Bank or the VFSC where the entity is also licensed.
The VFSC is the primary regulator for non-banking financial services. Its AML role covers licensing and supervision of Designated Non-Financial Businesses and Professions, including company and trust service providers, securities dealers, and virtual asset service providers.
Coordination runs through the National Coordinating Committee, where the VFSC heads the Supervisory Working Group and liaises with the VFIU through the Commissioner. The Commissioner also serves as Registrar of Companies, which links AML supervision directly to the corporate registry. Banks and financial institutions sit under the Reserve Bank, which supervises their AML obligations under the Financial Institutions Act and the International Banking Act.
Who Is a Reporting Entity Under the AML and CTF Act
The Act draws a line between businesses caught by the regime and those that are not. A reporting entity is any business carrying on the activities listed in the statute and its schedule, and those entities bear the full set of preventive obligations.
The enumerated sectors in Regulation Order 122 of 2014 include:
- Banks and financial institutions
- Securities and financial dealers
- Money exchange and value-exchange operators, including pawn shops
- Casinos and gaming operators, covering slots, lotteries, and online gaming
- Real-property transactions above VUV 1,000,000 (around USD 8,400)
- Company and trust service providers
- Virtual asset service providers, brought in by the VASPs legislation
Registration is a precondition, not an afterthought. Under section 9(3), a person carrying on a stipulated business must register with the VFIU, and any financial dealer must complete that registration before lodging a licence application with the VFSC.
For a foreign owner, the practical question is whether an International Company is itself a reporting entity. An IBC engaged in financial, fiduciary, or business services must implement customer due diligence and suspicious-transaction reporting in its own right.
A pure holding IBC with no financial-services activity may fall outside the active reporting-entity definition, but the registered agent that holds its records remains a reporting entity regardless. No blanket IBC exemption is confirmed in public sources, so verify your entity's scope directly with the VFIU.
Ongoing Compliance in Vanuatu
Keep your Vanuatu entity compliant with filings, returns, and statutory obligations.
Customer Due Diligence and KYC Requirements
Every reporting entity must identify and verify its customers, monitor their transactions, and keep the supporting records. The detail of acceptable identification documents and the verification process is set out in the regulations rather than the Act itself.
For most foreign owners, the obligation is felt through the registered agent. At incorporation and onboarding, the agent collects KYC documentation, which typically means a passport copy, proof of address, and evidence of source of funds.
Verification carries a hard stop. Where satisfactory evidence is not produced under section 13 of the Act, the entity must not proceed with the transaction and must report the attempt to the VFIU as suspicious.
Due diligence also reaches beyond the immediate customer to beneficial ownership, which reporting entities must establish and record. Certain events trigger CDD afresh:
- Onboarding a new customer
- Occasional transactions, particularly cash at or above VUV 1,000,000
- Wire or fund transfers lacking complete originator information
- Any doubt about identification obtained earlier
Where a transfer arrives without complete originator details (name, address, and account number), the entity must apply enhanced scrutiny and watch for suspicious activity. Each reporting entity must also appoint an AML&CTF Compliance Officer and maintain a written procedure manual covering CDD, record-keeping, the compliance-officer role, and risk-based audit systems.
Enhanced Due Diligence, PEPs, and the Risk-Based Approach
The regime is built on a risk-based approach. Rather than applying identical checks to everyone, an entity must identify and understand its money-laundering and terrorism-financing risks, then direct stronger measures where those risks are highest.
Higher-risk customers and transactions call for enhanced due diligence. The VFIU set out the operative framework in its 2015 Guidelines for Financial Institutions and addressed the risk-based approach further in Guidance Note 7 of 2017.
Politically Exposed Persons feature in the VFIU guidelines as a category warranting elevated attention. The public sources do not enumerate a standalone PEP threshold, so the operative text in the 2015 Guidelines is the reference point for how to treat such customers.
National-level risk assessment shapes where scrutiny concentrates. The National AML-CTF-CPF Strategy of August 2025 flags citizenship-by-investment programs, virtual asset providers, and the offshore sector as high-risk areas, which means entities active in those spaces should expect closer regulatory interest.
Vanuatu Incorporation Pricing
See transparent pricing to incorporate and maintain a company in Vanuatu.
Ongoing Monitoring of the Business Relationship
Due diligence does not end at onboarding. Reporting entities must monitor customer transactions throughout the relationship and maintain protocols to identify, monitor, and report suspicious activity.
The internal procedure manual ties this together, setting out reporting, CDD, record-keeping, and audit and risk-management systems. Independent audits are expected as regular reviews to find and close compliance gaps.
Staff awareness is part of the obligation. Officers and employees must be trained to recognise and handle money-laundering and terrorism-financing risks and to understand the entity's own procedures. VFIU Guidance Note 6 of 2017 addresses transaction-activity reporting, which sits close to the monitoring duty.
No statutory minimum frequency for internal risk reviews is published. The general principle, consistent with FATF standards, is periodic re-assessment proportionate to the risk the entity faces.
AML Record-Keeping Requirements
Records must allow any transaction to be reconstructed at any time, which means keeping CDD records alongside the reports submitted to the VFIU. KYC documentation and transaction records are to be retained for a minimum of seven years, a period confirmed operationally through Reserve Bank guidelines applying the Act's standards.
Storage can be digital, but the records must stay accessible. They are to be kept in Vanuatu and produced for review whenever the regulator requests them.
| Requirement | Position |
|---|---|
| Minimum retention | 7 years |
| Format | Digital permitted, must be readily accessible |
| Location | Kept within the jurisdiction |
| Beneficial ownership | Held by registered agent and VFSC, not public |
| Prescribed templates | Set by Regulation Order 122 of 2014 |
One point matters for owners concerned about privacy. The territory does not maintain a public register of directors, shareholders, or beneficial owners; that information is held privately by the registered agent and the VFSC, and authorities reach it only through proper legal process.
Suspicious Activity and Transaction Reporting to the VFIU
Three report types run to the VFIU: Suspicious Transaction Reports, Cash Transaction Reports, and International AML&CFT reports. The cash reporting threshold is VUV 1,000,000, roughly USD 8,400, with large-cash reporting covered by Guidance Note 5 of 2020.
Suspicious Transaction Reports follow a prescribed template under the 2015 amendment order and are addressed to the Director of the FIU. The templates are downloadable from the VFIU site, and no fixed number of days is publicly stated for filing; the governing principle, drawn from FATF Recommendation 20, is to file as soon as possible once suspicion arises.
Annual compliance filing is the obligation foreign owners are most likely to encounter. Each year by 31 March, every licensed financial dealer must file two compliance documents with the VFIU, with Guidance Note 1 of 2020 covering the compliance report and Guidance Note 4 of 2020 covering the registration form.
The filing can be delegated. A registered agent may submit the annual compliance documents on the entity's behalf and must keep copies as the law requires.
The Role of the Registered Agent in AML and KYC Compliance
For a non-resident, the registered agent is the practical centre of AML compliance. A Vanuatu IBC must maintain a registered office locally and engage a licensed agent at all times, and that agent files documents with the VFSC, including the annual return and changes to directors or constitutional documents.
The agent is the first KYC gatekeeper. Before forming a company, it collects the passport, proof of address, and source-of-funds evidence, and it is obliged by law to obtain information on all beneficial owners, directors, shareholders, bank-account signatories, and connected parties.
Crucially, the agent is itself a reporting entity as a company and trust service provider. It carries its own AML obligations: due diligence on the IBC and its beneficial owners, suspicious-transaction reporting, a compliance officer, and the maintenance of beneficial-ownership records that authorities can access through proper process.
Letting the agent relationship lapse is a serious risk. Failure to maintain a registered agent can lead to administrative penalties, deregistration, or personal exposure for directors.
Penalties and Enforcement for AML Breaches
Enforcement combines examination, administrative action, and criminal liability. The VFIU conducts on-site compliance examinations of reporting entities, sometimes with VFSC or Reserve Bank staff, and can issue compliance directions that must be followed.
The financial exposure on the regulatory side is significant.
| Measure | Detail |
|---|---|
| VFSC monetary penalty | Fine not exceeding VUV 125,000,000 |
| Licence action | Revocation, suspension, or conditions imposed |
| VASP-specific | Suspension or revocation for AML/KYC violations |
| Corporate consequence | Strike-off or deregistration of a non-compliant IBC |
| Public action | Public sanctioning of companies and directors |
Ignoring administrative directions raises the stakes, with possible licence cancellation, monetary penalties, or public sanction of the firm and its directors. An IBC that fails to file returns, keep an agent, or update beneficial-ownership information risks being struck off.
Criminal liability sits behind the administrative regime for money-laundering and terrorism-financing offences. The precise custodial figures are not enumerated in public summaries, so the consolidated Act is the reference for exact penalty provisions, and non-filing of a required Suspicious Transaction Report is itself an offence under its general provisions.
Conclusion
AML/KYC is the area where a Vanuatu structure most often meets real regulatory scrutiny, and for most foreign owners the weight of that compliance is carried by the licensed registered agent rather than by the owner directly. That arrangement works only if the agent is genuinely capable: the agent's own obligations, its examination exposure, and its record-keeping are effectively yours by extension.
The sensible next step is to confirm whether your specific entity is an active reporting entity or a passive holding company, since that single distinction determines how much of the regime falls on you. Choose an agent that treats the 31 March compliance filing and the seven-year record duty as routine, not afterthoughts.
How Expanship Can Help Your Business in Vanuatu
Expanship supports foreign-owned entities with the AML/KYC side of Vanuatu operations, from assembling KYC files and beneficial-ownership records to managing the annual VFIU compliance filings due by 31 March, and we extend that support to the full lifecycle of a company in the jurisdiction.
- Company formation and registry filings with the VFSC
- Licensed registered agent and registered office
- Ongoing compliance and filing management, including annual AML documents
- Accounting and bookkeeping support
- Economic-substance and beneficial-ownership assistance
- Banking introductions for the entity
To discuss your structure and compliance position, contact Expanship Vanuatu.
Frequently Asked Questions
It depends on what the company does. An IBC engaged in financial, fiduciary, or business services must implement customer due diligence and suspicious-transaction reporting itself, while a pure holding company with no financial-services activity may fall outside the active definition. The registered agent remains a reporting entity in either case, and the VFIU is the right party to confirm your scope.
KYC documentation and transaction records must be retained for a minimum of seven years. They may be held digitally, must remain readily accessible for inspection, and are to be kept within the jurisdiction so the regulator can review them on request.
The threshold for Cash Transaction Reports is VUV 1,000,000, which is roughly USD 8,400. The same figure also triggers customer due diligence for occasional cash transactions and applies to real-property transactions caught by the regime.
Every Vanuatu-licensed financial dealer must file two compliance documents with the VFIU by 31 March each year. A registered agent can submit these on the entity's behalf, and Guidance Notes 1 and 4 of 2020 explain the compliance report and the registration form.
The VFSC can impose a fine of up to VUV 125,000,000, revoke or suspend a licence, or attach conditions to it. A non-compliant IBC also risks strike-off, and money-laundering and terrorism-financing offences carry criminal liability under the consolidated Act.
No. The territory does not keep a public register of directors, shareholders, or beneficial owners; that information is held by the registered agent and the VFSC and is reached by authorities only through proper legal process.
Legal Disclaimer
The information provided in this article is for general informational purposes only and does not constitute legal, tax, or professional advice. While we strive to ensure the accuracy and timeliness of the content, laws and regulations are subject to change, and the application of laws can vary widely based on specific facts and circumstances.
Readers should not act upon this information without seeking professional counsel tailored to their individual situation. Expanship and its authors disclaim any liability for actions taken or not taken based on the content of this article.
For specific advice regarding your business setup, compliance requirements, or any legal matters, please consult with qualified legal and tax professionals in the relevant jurisdiction.
