Banking & Digital Banking Compliance in Armenia

Armenia's banking market is open to new entrants, including foreign bank branches and subsidiaries, but it is a single-regulator system: the CBA licenses banks, supervises their prudential and anti-money laundering (AML) compliance, and hosts the FMC. There is no separate digital bank licence; a digital-only bank holds the same banking licence as a branch-based one.

The biggest practical obstacle for a digital entrant is the treatment of remote onboarding. The rules permit it, but by classing non-face-to-face relationships as high risk they push fully remote customers into enhanced due diligence unless the bank has documented and filed an analysis supporting a medium rating, so onboarding flows and that analysis have to be designed from the start.

1. Who regulates this sector

The CBA is the banks' AML supervisor under their sector legislation (AML law, article 3(1)(8)).

2. Licensing and authorisation

The CBA has the exclusive right to grant a banking licence, which is perpetual and not transferable (Law on Banks and Banking, article 23). Only licensed entities may use the word "bank" or its derivatives in their name or advertising (article 6). The licence covers all channels: Armenian law has no separate licence for digital-only or app-based banks.

Deposit-guarantee amendments linked to the new resolution regime (Law HO-368-N) take effect on 1 January 2027 [Adopted, effective 1 Jan 2027]; they leave the coverage amounts unchanged.

3. AML, KYC and customer due diligence

Banks, including branches of foreign banks, are reporting entities under article 3(1)(4) of the AML law. The detailed rules sit in the CBA's Regulation on Minimum Requirements to Reporting Entities in the Field of Preventing Money Laundering and Terrorism Financing (Board Decision 279-N of 7 October 2014, last amended by Decision 11-N of 22 January 2026, in force 30 January 2026).

When customer due diligence applies

Customer due diligence (CDD) is required when a business relationship is established, for occasional transactions (including linked transactions and money or crypto-asset transfers) of 400 times the minimum wage or more, when there are doubts about identification data, and on any suspicion (article 16(2)). Thresholds in laws are calculated on a base of AMD 1,000 rather than the actual minimum wage (Law on Minimum Monthly Wage, article 3), so the occasional-transaction threshold is AMD 400,000; MONEYVAL's 2026 report puts it at about EUR 900. Investment service providers are reporting entities under the same law and CDD rules. Anonymous and numbered accounts, bearer shares and shell banks are prohibited (article 15).

Beneficial ownership

A beneficial owner is a natural person who directly or indirectly holds 20% or more of the voting shares or charter capital, or exercises control by other means; if nobody qualifies, the senior manager is treated as the beneficial owner (article 3(1)(14)). Banks must identify the beneficial owner, take reasonable steps to verify identity from reliable sources and document their reasoning (article 16(5) and (5.1)). The CBA regulation requires a declaration on the presence or absence of a beneficial owner (point 43). The CBA's Guidance on Determining the Beneficial Owner (22 October 2024) expects, depending on risk, a cross-check against the beneficial ownership database of the State Register of Legal Entities; if it shows inconsistencies, the customer should be given a reasonable time to correct the register, and an uncooperative customer refused or exited (points 41 and 42).

Risk-based tiers

Reporting and records

Thresholds come from article 6(3)(1) of the AML law; deadlines from CBA Board Decision 75-N of 8 May 2020 on bank reporting (points 11 and 12). Tipping off is prohibited (article 6(5)). A bank may suspend a suspicious transaction for up to 5 days and must do so on the CBA's instruction; the CBA, as authorised body, may suspend it for up to 15 days (article 26). Records, including CDD documents, are kept for at least five years after the relationship ends or the transaction is completed (article 22(2)), and may be kept electronically (Regulation 279-N, point 51).

4. Identity verification and onboarding

Banks identify and verify customers on the basis of reliable and valid documents and other information issued by a competent state authority (article 16(4)). For an individual the bank must record, at a minimum, the name, citizenship, registration address (if any), date and place of birth, and the series, number and issue date of the identity document, and must establish the customer's place of residence.

Timing and reliance

Since 8 August 2025, a bank may verify the identity of the customer, representative and beneficial owner after establishing the relationship, within a reasonable period of no more than seven days, if the risk is managed effectively and this is needed not to disrupt normal business (article 16(1)). It must adopt a policy setting the conditions, such as the type, number or value of transactions, under which the customer can transact before verification (article 18(3.1)); banks had to adopt it and file it with the CBA, the authorised body under the AML law, within two months of 8 August 2025. If verification then cannot be completed, the bank must end the relationship and consider whether to report it as suspicious (article 27(2)).

A bank may rely on CDD by another supervised institution outside non-compliant countries if it gets the data immediately and copies on request; it keeps ultimate responsibility (article 16(8)).

Methods

Neither the AML law nor Regulation 279-N prescribes a verification technology. Document capture, biometric face matching, liveness detection, video calls and electronic signatures are not named, approved or prohibited; the bank chooses its methods in its non-face-to-face risk policy (article 18(3)). Where an ID card is used to log in or sign, its electronic signature certificate is valid for the life of the card (Law on Electronic Document and Electronic Digital Signature, article 14), but only cards issued before 15 February 2023 and new-model cards under the Law on Identity Document (HO-210-N, in force 30 October 2026) have a usable chip. Holders of chipless cards use Mobile ID, a SIM-based credential issued at mobile operators' service centres.

Banks must screen customers and transactions against the UN Security Council lists and the terrorism and proliferation lists published by the CBA, freeze matches without prior notice and report each freeze as a suspicious transaction (article 28).

5. Digital channels: what's different

Bottom line: remote account opening is allowed and the identification data are the same as in a branch, but a relationship opened without face-to-face contact carries a CBA high-risk criterion, so it triggers enhanced due diligence unless the bank has filed a documented analysis supporting a medium rating, and it always requires a first-payment check that a branch customer does not face.

Non-face-to-face as a high-risk criterion

Regulation 279-N lists "a transaction or business relationship without face-to-face contact" as a high-risk criterion (point 27(6), redrafted by Decision 11-N, adopted 22 January and in force 30 January 2026). High-risk criteria are set by the CBA's legal acts and the bank's internal acts (AML law, article 3(1)(21)), and enhanced due diligence follows a high rating (article 18(2)). MONEYVAL found that Armenian banks themselves rate remote onboarding among their highest risks.

The CBA's Guideline on the Criteria of High Risk and the Indicators of Suspicious Activity in Relation to Money Laundering and Terrorist Financing (Chairman's Decision 1/711-A of 11 October 2016, amended by Decision 1/347-A of 24 September 2025) explains that the delivery-channel criteria target fully remote processes; a customer first identified face to face does not carry the criterion.

The first-payment rule

When a relationship is established without face-to-face contact, the bank must require the first payment to be made from an account opened in the customer's name at a financial institution that meets the reliance conditions in article 16(8)(3) of the AML law (Regulation 279-N, point 40).

Pending: electronic identification law

A draft Law on Electronic Identification and Trust Services [Proposed, comments close 17 Nov 2026], published by the Ministry of High-Tech Industry and Artificial Intelligence, would set assurance levels for electronic identification schemes, introduce an Armenian digital identity wallet, regulate trust services and repeal the current electronic signature law.

6. Data protection and biometrics

The Law on Protection of Personal Data («Անձնական տվյալների պաշտպանության մասին», HO-49-N, last amended 7 May 2026) governs identity capture; the AML law provides the basis for CDD data and its five-year retention.

Biometric data, defined as information on a person's physical, physiological and biological characteristics, may be processed only with the data subject's consent, unless a law provides otherwise and the aim can be achieved only by processing that data (article 13). As the AML law does not mandate biometrics, face matching or liveness checks need the customer's consent. Consent must be given in writing or electronically, certified with an electronic digital signature; oral consent counts only through reliable actions that clearly show it (article 9(7)). A tick-box alone may therefore not meet the rule, so remote flows should capture consent in one of these forms. Before processing biometric data, the controller must notify the Personal Data Protection Agency of the Ministry of Justice; this notification is mandatory (article 23(3)).

7. Sector-specific obligations

Wire transfers

The originating bank must include the names and account numbers (or a unique reference) of payer and payee in every transfer, and for transfers above 400 times the minimum wage (AMD 400,000) also the payer's identity document data, address, or date and place of birth (article 20). A transfer that lacks this information must be refused and considered for reporting (article 27(3)).

Outsourcing and third-party providers

Card security and tokenised payments

The CBA's card security rules (Board Decision 300-N of 4 November 2014, last amended by Decision 176-N of 30 June 2026) require banks that enable internet card payments to use a security system consistent with international standards, such as 3-D Secure or one-time codes, to prevent unauthorised transactions (point 18), to run real-time transaction monitoring 24/7 (point 19), and to send SMS or email alerts for card transactions when the cardholder opts in (point 21). Where cards issued by Armenian banks are serviced by banks in Armenia, including through token-based digital wallets, clearing and settlement must take place in Armenia (point 29.1).

Resolution

The Law on Bank Resolution (HO-363-N) [Adopted, effective 1 Jan 2027] gives the CBA tools to resolve failing banks, including bridge banks and asset separation, and adds a minimum requirement for total capital and subordinated liabilities available for resolution to the Law on Banks and Banking (Law HO-366-N).

8. Risk indicators and red flags

Indicators from the CBA guideline relevant to digital banking

• Doubtful identity data: data whose authenticity needs extra inquiry, or copies offered with excuses for missing originals.
• Altered documents: identity documents showing signs of alteration or falsification, or different documents presented on different occasions.
• Shared devices: several customers accessing online banking from the same electronic system, or with identical contact details.
• Structuring: fragmented transactions kept below reporting or CDD thresholds, or amounts reduced to avoid CDD.
• Dormant reactivation: accounts or payment instruments unexpectedly reactivated after long inactivity.
• Risky IP locations: online transactions with parties whose IP address is in a non-compliant country.
• Gambling flows: large numbers or amounts of transactions through accounts of internet betting companies.
• Crypto-asset obfuscation: funds presented as crypto-asset conversion proceeds, or use of mixers, tumblers and cross-chain bridges.

MONEYVAL identified fraud, corruption, tax crimes, drug trafficking and cybercrime among Armenia's main money laundering threats.

9. Enforcement and penalties

AML breaches by banks are sanctioned under the Law on Banks and Banking (AML law, article 30(2)). For each breach the CBA may impose, alone or together, a warning with an order to remedy, a fine, withdrawal of managers' qualification certificates, or revocation of the licence (article 61). Fines are set per violation (article 63(3)):

• up to 5% of the CBA's minimum charter capital for each breach of a prudential standard or late reporting to the CBA;
• up to 1% of the minimum charter capital, currently AMD 10 million, for each other breach of banking legislation.

A fine must not push the bank into serious financial difficulty, and if the bank contests it, the CBA collects it through the courts (article 63(1) and (4)). MONEYVAL notes that the CBA's sanctioning methodology has no quantitative fine formula and that published sanction information is brief.

10. Recent changes and what to watch

• 17 November 2026:[Proposed, comments close 17 Nov 2026] Public consultation ends on the draft Law on Electronic Identification and Trust Services, which would introduce eID assurance levels and an Armenian digital identity wallet.
• 1 January 2027:[Adopted, effective 1 Jan 2027] The Law on Bank Resolution and related amendments to the Law on Banks and Banking and the deposit guarantee law take effect, adding a loss-absorbing liabilities standard and a new creditor ranking.
• 21 August 2026:[In force] CBA rules on managing the risk of circumventing international sanctions (Decision 25-N, published 20 February 2026) apply to money transfer and e-money institutions, not to banks.
• 17 July 2026:[In force] CBA Decision 176-N of 30 June 2026 amended the card security rules, adding issuer limits for stand-in authorisation and updating alert and incident duties.
• 9 July 2026:[Published] MONEYVAL published Armenia's sixth-round report, adopted at its 71st Plenary (26 to 29 May 2026), and placed Armenia in enhanced follow-up, calling for better suspicious activity reporting and beneficial ownership accuracy.
• 18 May 2026:[In force] Amendments to the Law on Banks and Banking (HO-150-N) move statutory publications online.
• 30 January 2026:[In force] CBA Decision 11-N of 22 January 2026 redrafted the high-risk and low-risk criteria in Regulation 279-N, keeping non-face-to-face relationships as high risk.
• 24 September 2025:[In force] The CBA amended its guideline on high-risk criteria and suspicious activity indicators; the current version includes online banking and crypto-asset indicators.
• 8 August 2025:[In force] AML law reform (HO-261-N): seven-day delayed verification with a pre-verification policy, PEP checks extended to life insurance beneficiaries, and a rewritten targeted financial sanctions freezing regime.

11. What this means for identity verification

• Documents. Capture every article 16(4) data element, including place of birth, document issue date and place of residence.
• Remote methods. No approved list exists; the bank's non-face-to-face policy is what supervisors will test.
• Risk engine. Fully remote customers default to high risk, with senior management approval in the flow and six-monthly reviews (three-monthly for PEPs), unless a documented analysis filed with the CBA supports a medium rating or only listed low-risk payments are involved.
• Payments. Match the first incoming payment to an account in the customer's name at a regulated institution.
• Biometrics. Capture consent in a form article 9(7) accepts before face matching or liveness, and file the mandatory notification with the Agency first.
• Re-verification. Refresh identification and verification data at least once a year (art. 17(2)), separately from the point 38 schedule for other CDD data; keep evidence for five years after the relationship ends.