Fintech & Digital Payments Compliance in Armenia

Armenia is open to online payment and lending businesses, but in practice only through entities licensed in Armenia. One authority covers almost everything: the Central Bank of Armenia licenses and supervises payment and settlement organisations, credit organisations and e-money issuers, and its Financial Monitoring Center receives suspicious and threshold reports from all of them.

The biggest obstacle for a new entrant is that the licence comes before the customer: the payment law reserves payment services to the Central Bank, banks, licensed payment and settlement organisations and those authorised by another law or an international treaty. Once licensed, onboarding rules are principles-based, which leaves room for digital channels but puts the burden of proving their adequacy on the firm.

1. Who regulates this sector

2. Licensing and authorisation

The Law on Payment and Settlement Systems and Payment and Settlement Organisations («Վճարահաշվարկային համակարգերի և վճարահաշվարկային կազմակերպությունների մասին», HO-150-N of 2004, ARLIS 224826) defines payment services broadly, including e-money issuance, processing and clearing (article 17). Under article 18 only the CBA, banks, licensed payment and settlement organisations, the Treasury and persons authorised by another law or an international treaty may provide them. Providing payment services without a CBA licence is prohibited (article 19(4)).

Money transfer licence

For remittance, payment collection and payout services (article 19(1)(a)); holders may also process, clear and convert currency tied to a transfer (article 19(5)).

Processing and clearing licence

For processors and clearing houses for payment instruments and settlement documents (article 19(1)(b)).

E-money permission

Money transfer companies need a separate CBA permission under Regulation 16/1 (Decision 74-N of 13 April 2010, point 2); banks may also issue e-money.

Credit organisation licence

Lending apps need a credit organisation licence under the Law on Credit Organisations (ARLIS 209997, article 3); only licensees may use the term "credit organisation" in advertising (article 4).

The application covers participants and managers (including criminal records of 10% holders), service rules, a business plan and capital; the CBA decides within two months (article 20). Regulation 17/02 (CBA Board Decision 269-N of 14 October 2011) sets minimum total capital at AMD 100 million and highly liquid assets of at least 60% of current liabilities, both met on a monthly average basis (points 3, 4 and 7). State duty is AMD 1,000,000 per licence per year (Law on State Duty, articles 8 and 19). E-money issuers' systems must meet the CBA's minimum information security requirements (Regulation 16/1, point 4(3); Decision 173-N of 9 July 2013, based on ISO/IEC 27001).

3. AML, KYC and customer due diligence

The Law on Combating Money Laundering and Terrorism Financing («Փողերի լվացման և ահաբեկչության ֆինանսավորման դեմ պայքարի մասին», HO-80-N of 26 May 2008, ARLIS 210014) makes banks, credit organisations, currency exchange businesses, persons carrying out money transfers and most crypto-asset service providers reporting entities (article 3(1)(4)). Each must register with the FMC within one month of being licensed (article 9). The CBA's minimum requirements regulation (CBA Board Decision 279-N of 7 October 2014, ARLIS 220114, amended by Decision 11-N of 22 January 2026, in force 30 January 2026) adds detail.

When customer due diligence applies

Article 16(2) requires customer due diligence (CDD) when a business relationship is established; for an occasional transaction, including linked transactions and domestic or international money or crypto-asset transfers, of 400 times the minimum wage or more; when there are doubts about identification data; and on suspicion. For thresholds in legal acts the "minimum wage" is a fixed calculation base of AMD 1,000 (Law on Minimum Monthly Wage, article 3), so the occasional-transaction trigger is AMD 400,000.

What must be collected

Identity is established and verified from reliable, valid documents issued by a competent state body and other information (article 16(4)). For an individual: name, surname, citizenship, registration address (if any), date and place of birth, and the identity document's series, number and date of issue; the place of residence must also be established. The firm must also verify representatives' authority, identify and take reasonable steps to verify the beneficial owner, and understand the relationship's purpose (article 16(5) and (7)).

Beneficial ownership

A beneficial owner is a natural person who directly or indirectly holds 20% or more of the voting shares or of the charter capital, or who exercises actual control by other means; the senior manager is the fallback (article 3(1)(14)).

Enhanced due diligence, monitoring and reporting

Enhanced due diligence applies when a high-risk criterion is present, emerges during the relationship, or the FMC instructs it (article 18(2)). Monitoring runs at least annually for standard-risk and six-monthly for high-risk customers (regulation 279-N, point 37), and at least quarterly for politically exposed persons (point 41); other periods need a documented analysis submitted to the CBA (point 41.1). Identification and verification data must be refreshed at least once a year (article 17(2)); point 38's schedule covers other CDD information only.

Deadlines follow CBA Board Decision 266-N of 7 October 2014. Records are kept for at least five years after the relationship ends or the transaction is carried out (article 22), on paper or electronically (regulation 279-N, point 51).

4. Identity verification and onboarding

Neither the AML law nor regulation 279-N lists approved remote methods, sets a liveness or presentation-attack standard, or certifies identity providers. Instead, article 18(3) requires policies for managing non-face-to-face risks, including identification and verification, and the evidence must still be a valid state-issued document (article 16(4)). Since 1 August 2026, e-money issuers must document their wallet-opening CDD procedures (Regulation 16/02, point 8(20)).

Delayed verification

Verification may follow onboarding within no more than seven days if the risk is effectively managed and delay avoids interrupting normal business (article 16(1)); policy must limit the transactions allowed meanwhile (article 18(3.1)).

Reliance on third parties

A firm may rely on another institution's CDD but keeps ultimate responsibility and must obtain the information immediately from an AML-regulated party outside non-compliant countries (article 16(8)).

5. Digital channels: what's different

Bottom line: remote onboarding is permitted, but a relationship with no face-to-face contact is high risk by default, bringing enhanced due diligence unless a documented analysis submitted to the CBA supports a medium rating, plus a first payment from the customer's own account.

Remote onboarding as a high-risk criterion

Regulation 279-N lists a transaction or business relationship without face-to-face contact as a high-risk criterion (point 27(6)). Risk is high if even one high-risk criterion applies (points 23 and 25), triggering enhanced due diligence (article 18(2)). The exceptions: a firm may rate it medium after a comprehensive, documented analysis concluding the risks are effectively managed, submitted to the CBA as authorised body (point 22.1), and listed low-risk transactions can lower the rating (point 24). The CBA Guideline limits the criterion to relationships run entirely without face-to-face contact, payments included; face-to-face identification at some stage takes a relationship out of it (paragraph 1.3.2, note 40). App-only onboarding is therefore high risk by default.

The first-payment rule

For a non-face-to-face relationship, the first payment must come from an account in the customer's name at a financial institution meeting the article 16(8)(3)(a) to (c) conditions: AML-regulated, able to provide CDD data, outside non-compliant countries (regulation 279-N, point 40).

Wallets after the August 2026 reform

Regulation 16/02 (CBA Board Decision 2-N of 13 January 2015) caps e-money held in each user's accounts at AMD 1,000,000 equivalent at any time, however many accounts the user has (point 19). CBA Decision 177-N, in force since 1 August 2026, removed the requirement to link a bank account or card in the user's name before opening a wallet and identification through Armenian bank cards, allowed cash top-ups and redemptions, and repealed the 2022 restrictions on transfers combining cash and e-money accounts.

6. Data protection and biometrics

The Law on Protection of Personal Data («Անձնական տվյալների պաշտպանության մասին», HO-49-N, ARLIS 229131, amended 7 May 2026) governs identity data collected at onboarding. Biometric data need the data subject's consent unless a law provides otherwise (article 13), and the AML law does not mandate biometrics. Consent is given in writing, or electronically certified with an electronic digital signature; oral consent only through reliable actions that clearly show it (article 9(7)), and the processor must prove it (article 9(8)). A tick-box alone may therefore not meet the standard. Before processing biometric data, the processor must notify the Personal Data Protection Agency (article 23(3)). Vendors need written instructions (article 14).

7. Sector-specific obligations

Wire transfer information

Payment orders carry payer and payee names and account numbers or a unique reference; above AMD 400,000 they also carry the payer's document details, address, or date and place of birth (article 20).

Sanctions and asset freezing

Property of persons on lists under United Nations Security Council resolutions, or published by the authorised body in line with them, must be frozen immediately and without notice (article 28). The FMC's 2018 guidance (Decision 1/435-A) requires matching customers and counterparties against the lists, freezing or denying access on a match, and filing a suspicious transaction report (points 8 and 9).

Sanctions-circumvention controls

CBA Board Decision 25-N of 30 January 2026 (published 20 February 2026, in force 21 August 2026) applies to money transfer licensees and e-money issuers. "International sanctions" means measures by any international organisation or state, applied as they affect the firm (points 2 and 3). Risk-based controls must cover assessment, mitigation, monitoring, testing and reporting (point 2). Monitoring covers customers, counterparties, currencies and place of operation, and at least annually participants, staff and management (point 24). Customer checks consider linked persons, beneficial owners, citizenship, actual residential address and tax residence (point 25), at onboarding and within one working day of list or data changes (point 27); transactions are screened before execution (point 28). Firms weigh geography, keywords and the origin of goods (point 23) and run transaction-monitoring scenarios (point 31).

Safeguarding customer funds

Customer funds not yet paid out, including against e-money issued, must be kept separate and, from the end of the working day after receipt, held in a dedicated bank account or covered by insurance or a bank guarantee (Regulation 17/02, point 19). In July 2026 the CBA fined one organisation AMD 1,500,000 for breaches including 111 days of unprotected funds.

8. Risk indicators and red flags

Payment and e-money indicators from the CBA Guideline (1/711-A, amended by 1/347-A) and Decision 25-N

• High-risk IP addresses: online transactions where a participant's IP address is in a non-compliant (high-risk) country (2.2.2.59).
• Betting flows: transfers of large number or volume to the accounts of online bookmakers (2.2.2.61).
• Overpay and refund: overpaying into the tax authority's account from cards of unknown origin or foreign cards, then claiming a refund soon after without reasonable grounds (2.2.2.63).
• Document anomalies: only copies of identity documents, documents bearing signs of alteration or falsification, or a different identity document each time (2.1.1.4 to 2.1.1.6).
• Unreachable contacts: phone numbers that do not answer, are disconnected or do not exist; mail-drop addresses (2.1.1.9, 2.1.1.10).
• Crypto links: funds from or to a platform not registered in the country of the customer or of the wallet provider, or an address known to be linked to terrorism or its financing (2.2.2.64, 2.2.2.66).
• Sanctions evasion: exposure to heavily sanctioned countries, cities or regions, sanctions keywords, or goods and technology from sanctioned sources (Decision 25-N, point 23).

9. Enforcement and penalties

The AML law does not fine financial institutions directly: breaches of the AML law or the acts adopted under it lead to the measures in the institution's own sector legislation (article 30(2)). For payment and settlement organisations, article 27 of the payment law provides a warning with an order to remedy, a fine, withdrawal of a manager's qualification certificate, and licence suspension or revocation. The first three can be combined for each breach (article 27(2)), so total fines can exceed the per-breach cap.

On 10 and 11 August 2026 the CBA sanctioned nine payment and settlement organisations for breaches of the AML law and its implementing acts, after a risk-based assessment. Fines ranged from AMD 800,000 to AMD 2,100,000, with warnings.

10. Recent changes and what to watch

• 31 January 2027[Deadline, 31 Jan 2027] Crypto-asset service providers active before the Law on Crypto-assets must be CBA-licensed or stop.
• 17 November 2026[Proposed, comments close 17 Nov 2026] A draft Law on Electronic Identification and Trust Services would set assurance levels for electronic identification and create an Armenian digital identity wallet.
• 21 August 2026[In force] CBA Decision 25-N on sanctions-circumvention risk applies to money transfer and e-money companies.
• 10 to 11 August 2026[Enforcement] The CBA fines nine payment and settlement organisations for AML breaches after a risk-based assessment.
• 1 August 2026[In force] CBA Decision 177-N reforms wallet opening and funding.
• 9 July 2026[Published] MONEYVAL publishes Armenia's sixth-round evaluation, adopted at its 71st Plenary (26 to 29 May 2026), and places Armenia in enhanced follow-up. It rates financial-sector preventive measures moderately effective.
• 30 January 2026[In force] CBA Decision 11-N of 22 January 2026 rewrites the low-risk criteria in regulation 279-N (point 28).
• 24 September 2025[In force] Decision 1/347-A amends the CBA Guideline on the Criteria of High Risk and the Indicators of Suspicious Activity, including the scope of the non-face-to-face criterion.

11. What this means for identity verification

• Documents: capture the full article 16(4) data set from a valid state-issued document, not only an image.
• Remote methods: document capture, face match, liveness and NFC are permissible; justify the mix in the non-face-to-face policy.
• Enhanced due diligence by default: treat app-only customers as high risk unless a documented point 22.1 analysis, submitted to the CBA, supports a medium rating.
• Funding check: require the first payment from the customer's own account at a regulated institution.
• Seven-day window: limit transactions until verification completes, and stop activity after seven days.
• Re-verification: refresh identification data at least once a year and whenever data are in doubt, and retain evidence for five years.
• Sanctions: screen customers at onboarding and within one working day of list changes, and transactions before execution, against all relevant regimes.
• Biometrics: capture consent in a form that can be evidenced, notify the Agency before processing, and keep a non-biometric fallback.