AML, Sanctions and Beneficial Ownership in GMC: Building a Compliance Programme

Summary

• GFSO is the designated "Supervisory Authority" for money laundering in GMC (Financial Services Act 2025, s. 15A(3)); "money laundering" expressly includes terrorist financing and sanctions non-compliance (s. 15A(2)).
• It applies to every "Relevant Person": Licensed Firms, Designated Non-Financial Businesses or Professions (law firms, accountants, real estate agents, company service providers, dealers in items worth USD 15,000 or more), non-profit organisations and anyone GFSO deems in (s. 258; s. 15A(4)).
• A Relevant Person must conduct customer due diligence and keep records "as specified in the Rules" (s. 15B(4)–(5)); the detail sits in the AML and Sanctions Rulebook.
• Every Licensed Firm needs an Approved Person MLRO resident in GMC/Bhutan (GEN 5.5.1(1)(d), 5.5.2) and proportionate financial-crime systems and controls (GEN 3.3.38–3.3.40).
• Every GMC company must keep a non-public register of "registrable controllers" from incorporation, using a more-than-25% test (Companies Act 2025, ss. 386AF–386AG, Sixteenth Schedule); the LLP Act 2026 Part 6A is parallel.
• The Income Tax Act 2025 contains exchange-of-information machinery (Part 20A) and provision for FATCA, CRS-type, country-by-country and crypto-asset reporting agreements (Part 20B, s. 105K).

Why this matters before you apply for a licence

A GFSO Financial Services Licence issues only after In-Principle Approval conditions, including a bank account, are met. The bank will ask for a compliance programme it can defend to its correspondents. This article explains what the GMC statutes require. "$" and "USD" in GMC legislation and the Rulebooks mean United States dollars (Companies Act 2025, s. 4A; GEN 4.2, guidance para. 6).

Who the AML regime applies to

Section 15A(3) of the Financial Services Act 2025 (the Act) designates GFSO as "the Supervisory Authority for GMC" with "the power to supervise compliance with relevant money laundering laws". The obligations attach to a "Relevant Person", which means (s. 258):

The deeming power in s. 15A(4) means a technology vendor or marketplace that is not a Licensed Firm can still be brought within the AML regime by notice.

What the Act itself requires

Section 15B sets the statutory floor. A Relevant Person must comply with the anti-money laundering obligations that apply to it in GMC (s. 15B(1)) and with the Rules (s. 15B(2)), must conduct customer due diligence "as specified in the Rules" (s. 15B(4)), and must maintain records of customer due diligence, transactions and anti-money laundering measures "as prescribed in the Rules" (s. 15B(5)). Everything operational is therefore delegated to the Rules.

The AML and Sanctions Rulebook

GFSO lists an "Anti-Money Laundering and Sanctions Rulebook (AML)" among the subsidiary legislation under the Act, covering internal controls and measures against money laundering, terrorist financing and proliferation financing. Schedule B of the Application of Laws Act 2024 applies the AML Rules in GMC with modifications, principally the substitution of the GMC regulator (s. 5).

The full text of the AML Rulebook is not reproduced here. Two cross-references in GEN show how it slots in: the Money Laundering Reporting Officer (MLRO) has "day to day oversight of its compliance with the Rules in AML" (GEN 5.3.8), and firms are warned of "the residency requirement for an MLRO under AML 12.1.1(2)" (GEN 5.5.2, guidance para. 3). Build your programme against the AML Rulebook as published by GFSO, not against this summary.

The GEN Rulebook building blocks

Mandatory MLRO appointment

A Licensed Firm must appoint, and keep filled by Approved Persons at all times, a Senior Executive Officer, a Compliance Officer and an MLRO, plus a Finance Officer for banks and insurers (GEN 5.5.1(1)). Credit rating agencies are exempt from the MLRO requirement (GEN 5.5.1(2)). The MLRO must be a Director, Partner or Senior Manager responsible for implementing the firm's AML policies, procedures, systems and controls (GEN 5.3.8).

The Senior Executive Officer, Compliance Officer and MLRO must be resident in GMC/Bhutan (GEN 5.5.2). GFSO may waive the residency requirement for the Compliance Officer or MLRO, looking at the nature, scale and complexity of the business, time zones, the resourcing of a remote function and the officer's ability to liaise with GFSO (GEN 5.5.2, guidance para. 1; see our guide to waivers and modifications). GEN also states that the Compliance Officer, Finance Officer and MLRO roles "would not be expected to be combined with any other Controlled Functions" unless independent monitoring is in place (GEN 5.5.1, guidance para. 4).

Financial crime systems and controls

GEN 3.3.20 requires systems and controls to ensure the firm and its employees do not engage in, or facilitate, conduct that may constitute a Financial Crime "under any applicable Bhutan laws". GEN 3.3.38 requires effective systems and controls to deter and prevent fraud and other Financial Crimes and to report them to the relevant authorities. They must be "comprehensive and proportionate to the nature, scale and complexity of its activities" (GEN 3.3.39) and must take account of the firm's clients, products, distribution channels, transaction complexity and volume, processes and operating environment (GEN 3.3.40).

Staff, records and outsourcing

Employees must be fit and proper, competent and "trained in the requirements of the Regulations and Rules", with records to prove it (GEN 3.3.19). Records must be reproducible on paper within three Business Days (GEN 3.3.34(2)) and kept in English (GEN 3.3.36). A firm that outsources functions, including to a group entity, remains fully responsible; the outsourced function "shall be deemed as being carried out by the Licensed Firm itself" (GEN 3.3.31). Material outsourcing must be notified to GFSO, documented in a written contract and must not hinder GFSO's supervision (GEN 3.3.32). That governs any plan to run due diligence or monitoring from a group hub abroad. A significant breach of a Rule or of any applicable law must be notified to GFSO immediately (GEN 8.10.6).

Sanctions

The Act folds "sanctions non-compliance" into the definition of money laundering (s. 15A(2)), so the same supervisory powers, obligations and Rulebook apply. GFSO may disclose information to any authority exercising functions relating to "anti-money laundering, counter-terrorist financing or sanctions compliance, whether in GMC or otherwise" (s. 199(1)(b)(iii)), subject to ss. 197–199. Assume that screening obligations are real and that customer information can lawfully travel to foreign authorities.

Beneficial ownership: the register of controllers

GMC does not rely on the AML Rulebook alone for transparency of ownership. Part 11A of the Companies Act 2025 (ss. 386AA–386AP) requires companies and registered foreign companies to keep a register of controllers, and Part 6A of the LLP Act 2026 (ss. 42–57) does the same for limited liability partnerships.

Who is a controller

A person is a controller if it has "significant interest" in, or "significant control" over, the company (s. 386AB). Under the Sixteenth Schedule:

• significant control means the right to appoint or remove directors holding a majority of board voting rights, holding directly or indirectly more than 25% of members' voting rights, or having the right to exercise, or exercising, "significant influence or control" (para. 1);
• significant interest means an interest in more than 25% of the shares, or in shares carrying more than 25% of total voting power; for a company without share capital, a right to more than 25% of capital or profits (paras. 2–3).

A controller is "registrable" unless its interest is held only through another entity that itself keeps a register, is listed, or falls into other categories in s. 386AC.

What the company must do

• A company incorporated on or after 16 June 2025 must keep its register "starting on the date of the company's incorporation" (s. 386AF(1A)); registered foreign companies are treated the same way (s. 386AF(4A)).
• The company must take reasonable steps to identify its registrable controllers and serve notices on anyone it believes is a controller (s. 386AG). Controllers owe their own duties to supply and update information (ss. 386AJ–386AK).
• The register is not public (s. 386AF(11)), but the Registrar or an officer of the Authority may inspect it (s. 386AM), and a central register may be established by Gazette direction (s. 386AN).
• Non-compliance is an offence for the company and every officer in default, with a fine of up to $25,000 (s. 386AF(12)–(13)).

Part 11A applies to all natural persons "regardless of their citizenship or where they are resident" and to acts done outside GMC (s. 386AA(2)–(3)). Companies must also keep registers of nominee directors and nominee shareholders (ss. 386AKA, 386ALA). The LLP Act 2026 uses the same architecture: a non-public register of registrable controllers, a possible central register (s. 54) and $25,000 penalties (Part 6A, ss. 42–57).

For a Licensed Firm, these registers sit beside the regulatory concept of a "Controller" in GEN 8.8 (a 10% threshold). GFSO's change-of-control assessment asks whether "there are reasonable grounds to suspect that money laundering or terrorist financing has been, or may be, committed in connection with the proposed acquisition" (GEN 8.8.8, guidance para. 3(e); see our guide to change of control of a GMC licensed firm).

Tax transparency: exchange of information

International counterparties will also ask whether GMC exchanges tax information. The Income Tax Act 2025 answers that on its face.

Part 20A (ss. 105A–105HA) facilitates disclosure to a foreign "competent authority" under a double taxation arrangement or a stand-alone exchange-of-information arrangement declared by order (s. 105BA). A request cannot be refused merely because the information "is held by a bank or other financial institution, a nominee or a person acting in an agency or a fiduciary capacity, or it relates to the ownership interests in an entity" (s. 105D(4)).

Part 20B (ss. 105I–105Q) allows the designated officer to declare "international tax compliance agreements", expressly including a FATCA agreement with the United States, competent authority agreements based on the OECD standard for automatic exchange of financial account information, country-by-country reporting exchange agreements and crypto-asset reporting framework (CARF) agreements (s. 105K(1)). Under the regulations, prescribed persons must report to the Comptroller (s. 105L); failure carries a fine of up to $5,000, and knowingly false information up to $10,000 or two years' imprisonment (s. 105M). The Comptroller may authorise "an officer of the Gelephu Financial Services Office" to assist (s. 105N(2)(d)). The agreements declared are set out in Gazette orders; Basnet Law can confirm the current position.

Building the programme: practical checklist

1. Confirm your status: Licensed Firm, DNFBP, non-profit organisation, or at risk of being deemed a Relevant Person under s. 15A(4). DNFBP registration with GFSO is required for real estate agencies, dealers in precious metals or stones, dealers in any goods sold at USD 15,000 or more, accounting, audit, insolvency and tax consulting firms, law firms and notaries, Corporate Service Providers and non-profit organisations.
2. Obtain the current AML and Sanctions Rulebook from GFSO and map every due diligence, record-keeping and reporting rule to a written procedure (s. 15B).
3. Appoint an MLRO who is a Director, Partner or Senior Manager, resident in GMC/Bhutan, and apply for Approved Person status (GEN 5.3.8, 5.5.1, 5.5.2, 5.6). If a remote MLRO is unavoidable, prepare a waiver application under GEN 8.2 addressing each factor in GEN 5.5.2 guidance.
4. Document a business-wide financial crime risk assessment using the GEN 3.3.40 factors and have the Governing Body approve it.
5. Capture registrable controllers of corporate customers using the more-than-25% tests in the Sixteenth Schedule, and keep your own register of controllers current (s. 386AF).
6. Build sanctions screening into onboarding and payment flows; the Act treats sanctions non-compliance as money laundering (s. 15A(2)).
7. If any due diligence or monitoring is outsourced, put in place the written contract, contingency plans and GFSO access rights required by GEN 3.3.32.
8. Train all staff, keep the training records (GEN 3.3.19) and meet the three-Business-Day records standard (GEN 3.3.34).
9. Prepare for reporting under Part 20B and for exchange-of-information requests under Part 20A.

Frequently asked questions

Does a law firm or corporate services provider in GMC have AML obligations?

Yes. Law firms, accounting and audit firms and company service providers are DNFBPs and therefore Relevant Persons under s. 258 of the Financial Services Act 2025. They must register as DNFBPs with GFSO and conduct customer due diligence and keep records as specified in the Rules (s. 15B), even without a Financial Services Licence.

Must my MLRO live in GMC?

GEN 5.5.2 requires the Senior Executive Officer, Compliance Officer and MLRO to be resident in GMC/Bhutan. GFSO may waive the requirement for the Compliance Officer or MLRO case by case (GEN 5.5.2 guidance). The AML Rulebook has its own residency rule (AML 12.1.1(2), as referred to in GEN), so both must be satisfied.

Is the GMC register of controllers public?

No. A company must not disclose its register to the public (Companies Act 2025, s. 386AF(11)), but the Registrar can inspect it (s. 386AM) and a central register may be established by Gazette direction (s. 386AN).

What is the threshold for beneficial ownership in GMC?

More than 25% of shares or voting rights, or the right to appoint or remove a majority of the board, or actual significant influence or control (Companies Act 2025, Sixteenth Schedule, paras. 1–3). Which tax information agreements are in force under Part 20B of the Income Tax Act 2025 depends on orders made by the designated officer.

Key takeaways

• GFSO is the AML supervisor; the Act sets the floor (s. 15B) and the AML and Sanctions Rulebook the detail.
• The regime reaches DNFBPs, non-profits and anyone GFSO deems in, not only Licensed Firms.
• Every Licensed Firm needs a resident MLRO and proportionate financial-crime controls under GEN Chapters 3 and 5.
• Beneficial ownership is captured through non-public registers of controllers at a more-than-25% threshold, backed by $25,000 fines.
• Build your programme assuming tax information will be exchanged under Parts 20A and 20B of the Income Tax Act 2025.

This article is general information about the law of the Gelephu Mindfulness City Special Administrative Region as at the date above. It is not legal advice and does not create a lawyer–client relationship.

You may contact Basnet Law at basnet@basnetgmc.com or office@basnetgmc.com for any legal queries related to GMC.

References

• Financial Services Act 2025, ss. 15A, 15B, 197–199, 258 (definitions of "Anti-Money Laundering Legislation", "Designated Non-Financial Business or Profession", "Relevant Person")
• GEN Rulebook 2026 (v1.0, 7 May 2026), Rules 3.3.19, 3.3.20, 3.3.31, 3.3.32, 3.3.34, 3.3.36, 3.3.38–3.3.40, 4.2 (guidance para. 6), 5.3.8, 5.5.1, 5.5.2, 5.6, 8.2, 8.8.2, 8.8.8 (guidance), 8.10.6
• Companies Act 2025, ss. 4A, 145A, 386AA–386AP (Part 11A), Sixteenth Schedule
• Limited Liability Partnerships Act 2026, Part 6A (ss. 42–57)
• Income Tax Act 2025, Part 20A (ss. 105A–105HA), Part 20B (ss. 105I–105Q)
• Application of Laws Act 2024, s. 5 and Schedule B (AML Rules)
• GCRO FAQ for GMCA Entities (3 June 2026, v0.2), Gelephu Corporate Registration Office