Insurance & Insurtech Compliance in Armenia

The Armenian insurance market is open to online distribution. There is no separate digital licence. Insurance contracts must be in writing, and the Civil Code lets that written form be met electronically, including through a website or app, provided the contracting person is properly identified.

The Central Bank of Armenia is the single regulator: it licenses insurers and brokers, registers agents, supervises AML compliance, and houses the Financial Monitoring Center, Armenia's financial intelligence unit.

The biggest obstacle for a digital entrant is the first-payment rule for remote customers, combined with the absence of a prescribed remote identification method: the burden of designing, documenting and defending the online identity process sits with the insurer.

1. Who regulates this sector

2. Licensing and authorisation

The Law on Insurance and Insurance Activities («Ապահովագրության և ապահովագրական գործունեության մասին», adopted 9 April 2007, as amended in force from 18 May 2026; a further amendment to art. 15 applies from 1 January 2027) recognises three types of insurance: non-life, life and reinsurance, each divided into classes (art. 7). An insurer may not write both life and non-life classes; a reinsurer may reinsure both (art. 39(4) and (5)).

Insurers and reinsurers

The CBA registers and licenses insurers in one decision (arts. 38(1), 41). It decides within 30 days, a period it may suspend for up to 30 days (art. 41(3)). The licence has no expiry date, cannot be transferred and lists the classes the company may write (art. 38). The CBA sets minimum capital (art. 60): under its Regulation 3/02, charter capital of at least AMD 50 million, and total capital of at least AMD 1 billion for most non-life classes or AMD 1.5 billion for non-life classes 10 to 15 (which include motor liability), life or reinsurance (pts. 5 and 16). A holding of 10% or more of voting capital needs the CBA Board's prior consent (arts. 12 and 17).

Brokers and agents

Brokerage requires a CBA broker licence and is open only to legal persons; agency requires entry in the CBA's register of agents, backed by a contract with an insurer naming the classes and operations allowed (arts. 87 and 103).

3. AML, KYC and customer due diligence

The Law on Combating Money Laundering and Terrorism Financing («Փողերի լվացման և ահաբեկչության ֆինանսավորման դեմ պայքարի մասին», 26 May 2008, as amended to 13 November 2025) lists insurance companies, including reinsurers, and persons carrying on insurance or reinsurance intermediation as reporting entities and classes them as financial institutions (art. 3(1)(4) and (5)).

When due diligence applies

CDD is required when a business relationship (periodic services not limited to one-off transactions, art. 3(1)(12)) is established; for occasional transactions, including linked ones, of 400 times the minimum wage or more; when earlier identification data are in doubt; and on suspicion of money laundering or terrorist financing (art. 16(2)). With the AMD 1,000 calculation base (Law on Minimum Monthly Wage, art. 3), that threshold is AMD 400,000. Verification may follow onboarding by up to 7 days where risk is managed and delay avoids disrupting business (art. 16(1)), with limits on activity until it is complete (art. 18(3.1)).

Simplified and enhanced measures

Simplified due diligence is allowed where low-risk criteria apply, never where there is a high-risk criterion or suspicion (art. 18(5)). The CBA's Regulation on minimum requirements for reporting entities (Board Decision 279-N of 7 October 2014; points 27 and 28 restated by Decision 11-N of 22 January 2026, in force 30 January 2026) lists as low risk life policies with an annual premium of up to 400 times the minimum wage (AMD 400,000) or a single premium of up to 1,000 times (AMD 1,000,000), and pension-scheme policies with no surrender clause that cannot be pledged (pt. 28). Subject to narrow exceptions, risk is high if even one high-risk criterion applies (pt. 23), and the highest level governs where criteria conflict (pt. 25).

Ongoing due diligence

Identification and verification data must be refreshed at least once a year (AML Law, art. 17(2)); the schedule in Regulation 279-N, point 38 covers other CDD information and excludes identification data. Monitoring is due at least annually for standard risk, six-monthly for high risk (pt. 37) and three-monthly for PEPs (pt. 41), unless other periods are set after a documented analysis submitted to the CBA (pt. 41.1).

Beneficial ownership

A beneficial owner of a legal person is a natural person holding 20% or more of voting shares or charter capital, directly or indirectly, or exercising actual control (art. 3).

Sanctions

Property of persons on United Nations Security Council or national terrorism and proliferation lists must be frozen immediately (art. 28(1)), so customers, owners and beneficiaries need screening at onboarding and before payouts.

Reporting and records

Financial institutions report every non-cash transaction of AMD 20 million or more, every cash transaction of AMD 5 million or more and every crypto-asset transaction of AMD 1 million or more (art. 6(3)(1)). Under CBA Board Decision 262-N of 7 October 2014, insurers and intermediaries file threshold reports on form 002 by 18:00 on the third working day (pts. 15 to 17); the form's instructions address only the cash and non-cash thresholds. Suspicious transaction reports go to the FMC on the same working day the suspicion criterion is found or, if that is impossible, by 12:00 on the next working day, with no minimum amount (pt. 18; art. 6(2)). CDD data and transaction records are kept for at least five years after the relationship ends or the transaction is carried out (art. 22(2)), on paper or electronically (Regulation 279-N, pt. 51).

4. Identity verification and onboarding

Customers are identified and verified on the basis of reliable and valid documents issued by a competent state body, and other information (AML Law, art. 16(4)). For an individual the minimum data are full name, citizenship, registration address (if any), date and place of birth, the identity document's series, number and issue date, and place of residence (art. 16(4)(1)).

Neither the AML Law nor CBA Regulation 279-N prescribes a specific remote technique such as video identification, selfie and liveness checks or chip reading. Instead, every reporting entity must adopt and apply risk-management policies and procedures for non-face-to-face relationships, including how customers are identified and verified at onboarding and during ongoing monitoring (art. 18(3)).

An insurer may rely on CDD by another AML-regulated firm outside non-compliant countries, keeping final responsibility (art. 16(8)). Intermediaries must identify the policyholder before the policy takes effect (Insurance Law, art. 122(1)).

5. Digital channels: what's different

Bottom line: online sales are permitted under the same CDD rules as in-person sales, but a fully remote relationship is a high-risk criterion and the first premium must come from the customer's own account at a regulated financial institution.

The first-payment rule

For a relationship without face-to-face contact, the first payment must come from an account in the customer's name at a financial institution meeting the AML Law's reliance conditions (Regulation 279-N, pt. 40).

When remote counts as high risk

A relationship without face-to-face contact is a high-risk criterion (Regulation 279-N, pt. 27(6)). The firm may instead rate it medium risk if a comprehensive, documented analysis concludes that the risks are effectively managed and contained; the analysis is submitted to the CBA (pt. 22.1). The CBA's Guideline on the Criteria of High Risk and the Indicators of Suspicious Activity in Relation to Money Laundering and Terrorist Financing (Chairman's Decision 1/711-A of 11 October 2016, amended by Decision 1/347-A of 24 September 2025) limits the criterion to processes run entirely without face-to-face contact, payments included; if identification is done face to face at any stage, the criterion does not apply (section 1.3.2).

Electronic contracts and disclosure

An insurance contract must be in writing or it is void (Civil Code, art. 996(2)). The written form can be met electronically, including through a website or app, if the person concluding the contract is properly identified and can store it; unless a law requires otherwise, an unsigned electronic document has the same effect as a handwritten one (art. 450(3) to (3.3), as amended 24 May 2023).

Before contracting, an insurer must present all essential terms in writing and explain them orally (Law on Insurance and Insurance Activities, art. 81(1)); where a remote electronic sale makes oral contact impossible, the information is made available remotely, for example on the website (CBA Regulation 8/05 on business conduct, pt. 17).

6. Data protection and biometrics

The Law on Protection of Personal Data («Անձնական տվյալների պաշտպանության մասին», HO-49-N, 18 May 2015, as amended to 7 May 2026) governs identity capture. Biometric data may be processed only with consent, unless a law provides otherwise and its aim can be achieved only by processing them (art. 13); no law prescribes biometrics for insurance onboarding, so a face match or liveness check needs consent. Health data are special-category data and may not be processed without consent unless a law directly provides for it (arts. 3 and 12).

Before processing biometric or special-category data, the processor must notify the Personal Data Protection Agency (art. 23(3)), which covers insurers using health data and any firm running face match or liveness checks. Consent itself is given in writing or electronically, certified with an electronic digital signature; oral consent counts only through reliable actions that clearly show it, and the processor bears the burden of proving consent (art. 9(7) and (8)). A tick-box alone may therefore not meet the rule. This is separate from the Civil Code rule on the form of the insurance contract.

7. Sector-specific obligations

Life and investment-type beneficiaries

A reporting entity must identify the beneficiary of a life policy or other investment-type insurance contract as soon as the beneficiary is named or characterised, and verify the beneficiary's identity at the moment the claim is paid (AML Law, art. 18(4.1)). Firms must also check whether a beneficiary is a PEP (art. 18(2.1)) and weigh beneficiary data in risk assessment (art. 18(2)). Life insurance beneficiaries are a high-risk criterion in their own right (Regulation 279-N, pt. 27(8)).

Outsourcing and claims handling

An insurer may delegate functions such as agency services and claims handling to another legal person (art. 53), with the CBA's prior permission (art. 54), and remains liable for the contractor's performance (art. 53(3)).

Customer information and cooling-off

An individual may cancel a contract within 7 working days for a pro-rata refund, except for contracts of up to one month, compulsory insurance or where a claim was made (Insurance Law, art. 81(5.1)). When distribution runs through intermediaries, the insurer must ensure the intermediary discloses the required information (Regulation 8/05, pt. 17.1), and an agent must show the client that it is registered (Insurance Law, art. 102).

Compulsory motor liability («ԱՊՊԱ»)

Compulsory motor third-party liability is governed by the Law on Compulsory Insurance of Liability Arising from the Use of Motor Vehicles («Ավտոտրանսպորտային միջոցների օգտագործումից բխող պատասխանատվության պարտադիր ապահովագրության մասին», 18 May 2010, as amended in force from 18 May 2026). The CBA regulates and supervises the Armenian Motor Insurers' Bureau, a public organisation that sets conduct rules for its members (arts. 28 to 30). Only Bureau members licensed for motor liability with a branch or agent in every region may write this cover (art. 4(1)).

8. Risk indicators and red flags

The FMC's Typology 9 on money laundering through insurance operations (CBA Chairman's Decision 1/04-A of 15 January 2010) describes two schemes: a claim staged with forged documents, sometimes with an intermediary's help; and a third-party-funded policy cancelled within the permitted period for a premium refund.

Insurance ML/TF indicators from FMC Typology 9 and CBA rules

• Premiums out of profile: premiums clearly inconsistent with the policyholder's business or income (Typology 9).
• Third-party premiums: premiums paid by a third party, often unrelated to the policyholder (Typology 9; CBA Guideline 1.3.1.3).
• Unlinked beneficiary: no formal connection between policyholder and beneficiary (Typology 9).
• Early or doubtful claim: an insured event occurring early or in suspicious circumstances (Typology 9).
• Early cancellation: a policy terminated early with premiums refunded (Typology 9).
• Fully remote relationship: onboarding and payment with no face-to-face step (Regulation 279-N, pt. 27(6); CBA Guideline 1.3.2).
• PEPs and life beneficiaries: a PEP customer, owner or beneficiary, or a life policy beneficiary (Regulation 279-N, pt. 27(7) and (8); AML Law, art. 18(2.1)).
• Unusual size or terms: unusually large transactions or terms with no apparent lawful purpose (Regulation 279-N, pt. 27).

The typology calls for enhanced due diligence and detailed checks of claims and early terminations.

9. Enforcement and penalties

A financial institution's breach of the AML Law is sanctioned under the legislation governing its activity (AML Law, art. 30(2)), for insurers the Law on Insurance and Insurance Activities (art. 143(1)). Within one year of discovering a breach, the CBA may impose: a warning with an order to remedy or prevent recurrence; a fine; withdrawal of a manager's or responsible person's qualification certificate; or revocation of the licence (art. 145).

Fines are per breach. For the supervised firm the ceiling is 2,500 times the minimum wage (AMD 2.5 million per breach); for a manager or responsible person it is 1,000 times (AMD 1 million), paid from personal funds (art. 147(2) and (4)). A fine generally follows only where a warning has failed or recurrence is likely (art. 147(1)).

The CBA publishes its sanctions. In June 2026 it fined EFES insurance CJSC AMD 8 million and issued a warning for breaching the single-risk limit at three reporting dates in 2025 and 2026 and reporting the exposure unreliably. MONEYVAL records one suspicious transaction report from insurance companies between 2020 and 2024.

10. Recent changes and what to watch

• 9 July 2026[Published]: MONEYVAL published Armenia's sixth-round mutual evaluation, describing insurance as a lower-risk sector.
• 18 May 2026[In force]: amendments to the Law on Insurance and Insurance Activities allow electronic disclosure of insurance secrets to authorities and website notices.
• 30 January 2026[In force]: Decision 11-N of 22 January 2026 restated points 27 and 28 of Regulation 279-N (high-risk and low-risk criteria).
• 24 September 2025[In force]: the CBA's high-risk and suspicious-activity Guideline was last amended (Decision 1/347-A). In its current text the non-face-to-face criterion covers only fully remote processes.

11. What this means for identity verification

• Documents: verify against valid state-issued identity documents and capture the full data set in art. 16(4), including residence.
• Remote method: no technique is prescribed, so whatever method the firm chooses must be set out in its written non-face-to-face procedures.
• Payment as a control: match the first premium's payer and account to the verified customer for every remote relationship.
• Biometrics: notify the Personal Data Protection Agency before processing and obtain consent in a form art. 9(7) accepts.
• Annual refresh: refresh identification and verification data at least once a year (art. 17(2)).
• Payout: re-verify life and investment beneficiaries, and screen them for PEP status, before paying claims.
• Contract: an app or web acceptance meets the written form only if the signer is properly identified.