Updated enhanced version incorporating recommended technical and practical refinements for publication.

Quick Summary

• AML/CFT compliance in Qatar is governed by Law No. (20) of 2019, as amended, including the recent amendments introduced by Law No. 18 of 2025.
• Oversight is split across key authorities depending on sector, including QCB, QFCRA, MOCI, NAMLC, and QFIU.
• Core obligations include documented risk assessments, customer due diligence, beneficial ownership verification, transaction monitoring, suspicious transaction reporting, governance, training, and record retention.
• Non-compliance may result in significant administrative sanctions, including substantial monetary penalties that may reach QR100 million in certain circumstances, plus potential criminal liability.
• Qatar is not currently on the FATF grey list, reflecting continued alignment with international AML/CFT standards.

Table of Contents

1. What Is AML/CFT Compliance? 
2. Qatar's AML/CFT Legal Framework
3. Who Regulates AML/CFT Compliance in Qatar?
4. Who Must Comply? 
5. Core Compliance Obligations 
6. Penalties for Non-Compliance 
7. Qatar's International Standing 
8. Building a Defensible Compliance Program 
9. Common Compliance Gaps 
10. How HLB AG Supports AML/CFT Compliance 
11. Why Beneficial Ownership Compliance Matters in Qatar
12. Conclusion 
13. Frequently Asked Questions

1. What Is AML/CFT Compliance?

AML (Anti-Money Laundering) and CFT (Counter-Financing of Terrorism) compliance refers to the policies, controls, and reporting duties organizations must maintain to prevent the financial system from being used to launder illicit proceeds or fund terrorism. In Qatar, this is not a voluntary best practice sitting alongside general good governance — it is a statutory obligation with specific legal duties, reporting obligations, supervisory expectations, and penalties attached to it.

2. Qatar's AML/CFT Legal Framework

Qatar's AML/CFT regime is built on Law No. (20) of 2019 on Combating Money Laundering and Terrorism Financing, passed on 11 September 2019 and effective 1 February 2020, when it repealed the earlier Law No. (4) of 2010. Compared to the 2010 law, Law No. 20 strengthened the risk-based approach, expanded the law's reach, and reinforced supervisory and reporting obligations. 

The law has been amended since enactment, including by Decree Law No. 19 of 2021 and the more recent Law No. 18 of 2025. Council of Ministers' Decision No. 14 of 2021 also updated the implementing regulations. These developments mean AML/CFT compliance in Qatar must be treated as a program that is actively maintained, periodically reviewed, and updated when legislation, regulatory expectations, or the business risk profile changes. 

Firms operating within the Qatar Financial Centre (QFC) are also subject to a parallel rulebook — the AML/CFT Rules 2019, issued by the Qatar Financial Centre Regulatory Authority (QFCRA) and effective 1 February 2020 alongside the state law.

3. Who Regulates AML/CFT Compliance in Qatar?

Unlike jurisdictions with a single AML regulator, Qatar splits supervision by sector: 

• Qatar Central Bank (QCB) — the primary regulator for banks, exchange houses, insurers, and other licensed financial institutions; issues AML/CFT instructions and conducts on-site and off-site inspections. 

• Qatar Financial Centre Regulatory Authority (QFCRA) — regulates relevant persons operating in or from the QFC under the QFC AML/CFT Rules 2019. 

• Ministry of Commerce and Industry (MOCI) — supervises certain DNFBP sectors outside the QFC, including auditors, dealers in precious metals or stones, and trust and company service providers. 

• National Anti-Money Laundering and Terrorism Financing Committee (NAMLC) — the body established under Article 29 of Law No. 20, responsible for national AML/CFT strategy and coordination across authorities. 

• Qatar Financial Information Unit (QFIU) — Qatar's financial intelligence unit, established under Article 31 of Law No. 20, which receives, analyses, and acts on suspicious transaction reports. 

Which of these applies to a given business determines the rulebook, reporting channel, and inspection regime it falls under — so identifying the right regulator is the first practical step, not an afterthought.

4. Who Must Comply?

AML/CFT obligations apply to two broad categories: 

• Financial institutions — banks, exchange houses, insurance companies and brokers, securities and commodities firms, investment managers, and other licensed financial businesses. 

• Designated Non-Financial Businesses and Professions (DNFBPs) — chartered accountants, accounting firms, external auditors, audit firms, real estate brokers, dealers in precious metals and precious stones, trust and company service providers, and other designated activities prescribed by law or regulatory authorities. 

Audit and accounting firms may fall within the DNFBP framework when undertaking specified activities subject to AML/CFT requirements, making compliance an increasingly important aspect of professional practice. 

Businesses outside these categories are not automatically exempt in practice. Banks, auditors, lenders, and regulators increasingly expect companies — regulated or not — to demonstrate basic AML awareness, clear source-of-funds documentation, and beneficial ownership transparency as a condition of opening accounts, passing an audit, or securing financing.

5. Core Compliance Obligations

Under Law No. 20 of 2019 and its implementing regulations, in-scope entities are expected to maintain: 

• Risk-based assessment — a documented evaluation of exposure based on customer type, geography, products, services, delivery channels, and transaction risk, which should be reviewed periodically and updated whenever there are material changes to the business or its risk profile. 

• Customer due diligence (CDD) — verifying customer identity and understanding the nature and purpose of the business relationship before onboarding, including identifying and verifying beneficial ownership. 

• Beneficial ownership and transparency — entities must obtain and maintain adequate, accurate, and up-to-date information regarding the ultimate beneficial owners (UBOs) of legal persons and legal arrangements. Enhanced scrutiny should be applied where ownership structures are complex, opaque, or involve higher-risk jurisdictions. 

• Enhanced due diligence (EDD) — applying additional measures for higher-risk customers and transactions, including politically exposed persons (PEPs), high-risk jurisdictions, correspondent banking relationships, and complex ownership structures. 

• Ongoing transaction monitoring — maintaining systems and procedures to identify activities that are inconsistent with a customer's known profile, expected behavior, source of funds, or source of wealth. 

• Suspicious transaction reporting — suspicious transactions and activities must be reported to the Qatar Financial Information Unit (QFIU) promptly and in accordance with the AML/CFT Law, implementing regulations, and applicable supervisory authority requirements. Reporting obligations apply regardless of transaction value and include attempted transactions where suspicion exists. 

• Record keeping — customer due diligence records, transaction records, and supporting documentation should be retained in accordance with applicable AML/CFT legislation and supervisory requirements, generally for a period of up to ten years following the end of the business relationship or completion of the transaction. 

• Governance and compliance oversight — maintaining documented AML/CFT policies and procedures, appointing an appropriately empowered compliance officer, providing ongoing staff training, and conducting independent reviews of the effectiveness of the AML/CFT framework.

6. Penalties for Non-Compliance

Enforcement under Law No. 20 operates through both administrative and criminal sanctions. 

Administratively, regulators may impose a range of supervisory measures, including corrective actions, restrictions on business activities, suspension of licences, removal or restriction of directors and senior officers, and substantial financial penalties. In certain circumstances, administrative fines may reach QR100 million, depending on the nature and severity of the violation. 

Criminal liability may also arise for entities and individuals involved in money laundering or terrorism financing offences. Depending on the circumstances, penalties may include significant fines, confiscation of assets, and imprisonment. 

In practice, the financial penalty is often only one component of the potential impact. Regulatory findings can lead to restrictions on banking relationships, increased regulatory scrutiny, delayed financing transactions, reputational damage, and heightened audit concerns that may affect business operations long after the enforcement action has concluded.

7. Qatar's International Standing

Qatar's AML/CFT law is explicitly modelled on Financial Action Task Force (FATF) standards, and Qatar is not currently on the FATF list of jurisdictions under increased monitoring — the so-called grey list. That standing has commercial weight: banks, correspondent institutions, and international partners routinely factor a country's FATF status into the due diligence friction applied to counterparties based there.

8. Building a Defensible Compliance Program

A defensible AML/CFT program in Qatar typically includes: 

1. A documented, dated enterprise-wide risk assessment that is reviewed at least annually and updated when the business undergoes material changes.
2. Clearly documented customer due diligence and enhanced due diligence procedures, including escalation protocols for higher-risk relationships. 
3. Processes for obtaining, verifying, and maintaining accurate beneficial ownership information. 
4. A designated compliance officer with adequate authority, resources, and access to senior management. 
5. Monitoring controls proportionate to the size, complexity, and risk profile of the business. 
6. Procedures to document source of funds and source of wealth where appropriate. 
7. A comprehensive audit trail demonstrating the operation and effectiveness of compliance controls. 
8. Periodic independent testing or review of the AML/CFT framework, separate from day-to-day compliance activities.

9. Common Compliance Gaps

Most compliance failures are not caused by deliberate misconduct but by weaknesses in governance and implementation. Common examples include: 

• Risk assessments prepared once and never updated. 
• Failure to adequately identify and verify ultimate beneficial owners. 
• Incomplete source-of-funds or source-of-wealth documentation. 
• Suspicious transaction reporting procedures that exist on paper but have never been tested in practice. 
• Insufficient monitoring of customer activity relative to the entity's risk profile. 
• Weak staff awareness and training programs. 
• Record retention practices that fail to meet regulatory requirements. 
• Lack of independent review or testing of AML/CFT controls. 

These weaknesses frequently arise during regulatory inspections, bank onboarding reviews, lender due diligence exercises, and external audits.

10. How HLB AG Supports AML/CFT Compliance

HLB AG supports organisations across regulated sectors and DNFBPs in designing, implementing, and strengthening AML/CFT compliance frameworks aligned with Qatar's regulatory requirements and international best practices. 

Our services include: 

• Enterprise-wide AML/CFT risk assessments 
• Independent AML/CFT reviews and compliance health checks 
• AML/CFT policy and procedure development 
• Beneficial ownership and UBO reviews 
• Compliance officer advisory support 
• AML/CFT governance assessments 
• Staff awareness and compliance training 
• Regulatory remediation and enhancement projects 
• Bank and lender compliance readiness reviews 
• Independent testing of AML/CFT controls 
• Assistance with regulatory inspections and compliance gap remediation 

Whether preparing for a regulatory review, external audit, bank onboarding process, financing transaction, or internal governance initiative, HLB AG helps organisations develop practical and defensible AML/CFT compliance frameworks tailored to their specific risk profile. 

Learn more about our AML/CFT Compliance Services in Qatar. 

If you are specifically preparing for a bank credit facility review, our related guide covers what lenders assess and how businesses can prepare.

11. Why Beneficial Ownership Compliance Matters in Qatar

Beneficial ownership transparency has become a central component of AML/CFT compliance in Qatar. Regulators, financial institutions, auditors, and lenders increasingly require organisations to demonstrate a clear understanding of who ultimately owns or controls a business. Failure to maintain accurate beneficial ownership records can result in onboarding delays, enhanced scrutiny from financial institutions, compliance findings, and increased regulatory risk. As a result, organisations should ensure that beneficial ownership information is documented, regularly reviewed, and supported by appropriate verification procedures.

Conclusion

AML/CFT compliance in Qatar has moved well past a documentation exercise. With the underlying law amended multiple times since 2019, oversight split across several regulators, and real financial and criminal exposure for gaps, businesses need a compliance program that is current, evidenced, and reviewed — not one that was written once and never revisited.

Frequently Asked Questions (FAQ)

1. What law governs AML/CFT compliance in Qatar?
Combating Money Laundering and Terrorism Financing, as amended, including recent amendments introduced by Law No. 18 of 2025.

2. Who regulates AML/CFT compliance in Qatar?
It depends on sector: QCB oversees many financial institutions, QFCRA oversees relevant persons operating in or from the QFC, and MOCI supervises certain DNFBP sectors outside the QFC, with QFIU acting as Qatar's financial intelligence unit.

3. How quickly must a suspicious transaction be reported?
Suspicious transactions and activities should be reported promptly (within 24 hours, the off days are not considered in the calculation) to QFIU and in accordance with the timelines and procedures prescribed by the AML/CFT Law, implementing regulations, QFIU guidance, and applicable supervisory authority requirements.

4. How long must AML records be kept?
Records should be retained in accordance with applicable AML/CFT legislation and sector-specific supervisory requirements, generally for a period of up to ten years following the end of the business relationship or completion of the transaction.

5. What are the penalties for non-compliance?
Penalties may include administrative sanctions, substantial monetary penalties that may reach QR100 million in certain circumstances, licence restrictions or suspension, criminal fines, imprisonment for convicted individuals, and reputational consequences.

6. Is Qatar on the FATF grey list?
No. Qatar is not currently among the jurisdictions under increased monitoring.

7. How often should an AML/CFT risk assessment be updated?
At least annually and immediately whenever the business's activities, customer base, ownership structure, products, services, geography, or risk exposure changes materially.

©2026 Antonio Ghaleb and Partner CPA and HLB AG-Members of HLB. All rights reserved. These highlights have been prepared for general guidance on matters of interest only and do not constitute professional advice. You should obtain professional advice before taking action on the information contained in these highlights. Antonio Ghaleb and Partner CPA and its employees do not give any representation or warranty (express or implied) regarding the accuracy or completeness of the information contained in these highlights. Antonio Ghaleb and Partner CPA and its employees do not assume any responsibility, liability, duty of care for any negative consequences that may result in reliance to these highlights and for any decision based on them.