AML/CFT/CPF in Nepal — Reporting Entities, Regulators and Customer Controls

The registered shareholder can be an intermediary rather than the ultimate controlling person. Follow ownership and control through the structure, document uncertainty and apply the sector's escalation requirements. A form with every box filled is not adequate if the evidence is unreliable.

A professional firm is asked to help establish a company with several corporate shareholders and a proposed asset purchase. It first determines whether the activity falls within its AML obligations, then identifies the client and authorised representative, traces beneficial ownership and assesses source/purpose and risk. A client's insistence on confidentiality does not justify omitting required checks.

Assign compliance responsibility, document acceptance and escalation, train relevant staff and control access to sensitive records. Use enhanced measures for risks requiring them under the applicable rules. Suspicion must be escalated and assessed independently of whether a transaction exceeds a reporting threshold.

Maintain the regulator, directive version, covered activities, reporting channel, threshold provisions and retention requirements for each business line. Authorised personnel should handle reporting decisions and confidential records under the law applicable to that activity.

For an audit firm, ICAN's STR Guidance Note, effective 1 January 2026, draws an important boundary. Auditors report suspicious transactions discovered through audit work. They are not required to conduct separate customer due diligence, AML risk assessments or investigations to prove money laundering in the manner required of other reporting entities. Ordinary audit responsibilities, including consideration of relevant laws under NSA 250, continue to apply.

A firm providing non-audit services must assess the activity against the Act’s specified professional and company/trust-service categories. These include covered work involving real estate, client funds or securities, company formation or management, and business purchases or sales. The audit-only boundary does not remove duties arising from a separate covered engagement. Record the service performed and the applicable sector directive in the engagement file.

A company document identifies the legal shareholder; it may not identify the person exercising ultimate ownership or control. Where customer due diligence applies, examine corporate shareholders, voting arrangements and authorised representatives, then resolve the ownership chain using reliable evidence. If control cannot be explained, the file needs a reasoned escalation rather than an assumed name entered to complete a form.

Consider a Nepal company owned by two overseas holding companies. A director provides each company's registration certificate, but one shareholder's nominee arrangement gives another person authority to direct the investment. The relevant assessment follows that control relationship and the source and purpose of the proposed funds. Nationality alone does not establish high risk, and a familiar client relationship does not establish low risk.

Threshold reporting applies to defined transactions and aggregation periods. Suspicious reporting follows a properly assessed concern and can apply below a threshold or to an attempted transaction. FIU's July 2025 guidance gives separate procedures for each. A compliance officer should retain the facts, assessment, submission and acknowledgement through the authorised confidential process.

For the governing activity, the useful outcome is a documented decision: accept the relationship under stated controls, request missing evidence, escalate an unresolved concern, or report through the prescribed channel. The file should explain which decision was made and why, without revealing a confidential report to the customer.