October 30, 2026 · Jurisdiction Briefing · 7 min read

Qatar: the QFC’s AML/CFT Rules replace the 1 June reporting date with one set by notice, and add a duty to report on policies

Version 5 of the Qatar Financial Centre’s Anti-Money Laundering and Combating the Financing of Terrorism Rules 2019 (AML/CFTR) gave a fixed date for the MLRO’s annual report, with senior management’s written confirmation, to reach the regulator: before 1 June of the next year. Version 6, effective 1 May 2026, replaces that date with one the QFC Regulatory Authority (QFCRA) specifies by notice. The same amendments add a general duty to give the regulator reports and information on AML/CFT policies, and take one new type of firm out of the AML/CFTR altogether.

This briefing compares Version 5 of the rules (effective 1 October 2025) with Version 6 (effective 1 May 2026), using the two amending instruments to confirm what changed.

Where the changes come from

Version 6 of the AML/CFTR includes amendments made by two instruments: the INMA (Wholesale Advisory Firms) Amendments Rules 2026 (QFCRA Rules 2026-1) and the REPO and Miscellaneous Amendments Rules 2026 (QFCRA Rules 2026-2). The rulebook’s history records both as made on 30 March 2026 and commenced on 1 May 2026. In a release dated 5 April 2026, the QFCRA said it had issued the amendments and that they would commence on 1 May 2026.

The second instrument’s explanatory note for the AML/CFTR states the purpose: the amendments require certain reports, documents and other information to be provided to the regulator within a time it specifies in a notice published on its website, and ensure the consistent use of the term “Regulator”. (The rules previously said “Regulatory Authority” in several places.)

Change 1: the MLRO’s annual report no longer has a fixed deadline

The duty itself is unchanged. The MLRO must give senior management a report for each calendar year (rule 2.3.7 (2)). Rule 2.3.8 sets the minimum content. The report must assess the adequacy and effectiveness of the firm’s AML/CFT policies, procedures, systems and controls, and must cover, among other things, the numbers and types of internal suspicious transaction reports, how many went on to the FIU and why, breaches, training, the number and types of customers categorised as high risk, and progress on AML/CFT action plans.

Under rule 2.3.9 (2), senior management must confirm in writing that it has considered the report and, if an action plan is required, that it has approved the plan. The MLRO then gives the regulator a copy of the report and the confirmation.

What changed is the deadline:

	Version 5 (effective 1 October 2025)	Version 6 (effective 1 May 2026)
Rule 2.3.9 (2): MLRO’s annual report and senior management’s confirmation	before 1 June of the next year	before the date specified by the Regulator, by notice published on an approved website

Change 2: the same for firms with a non-resident MLRO

Division 2.3.D carries extra obligations for a firm whose MLRO is not ordinarily resident in Qatar. Under rule 2.3.10, such a firm must report to the regulator in a form approved under the General Rules 2005. Version 5 required this report before 1 June in each year. Version 6 requires it before the date specified by the Regulator, by notice published on an approved website.

The rest of the division is unchanged in substance. The firm must ensure the MLRO inspects its operations in Qatar frequently enough to assess the accuracy and reliability of what is reported under rule 2.3.10 (rule 2.3.11). And if the regulator considers the MLRO function is not being adequately exercised by a non-resident individual, it may direct the firm to require that individual to be ordinarily resident in Qatar or to appoint another individual who is (rule 2.3.12; only its heading was amended).

Change 3: the independent review record

Rule 2.1.1 requires every firm’s AML/CFT programme to include an independent review and testing of compliance with its AML/CFT policies, procedures, systems and controls. That review must be adequately resourced and conducted at least once every 2 years, by a person who is professionally competent, qualified and skilled, and independent of the function reviewed and of the part of the firm where it is performed. Those conditions are unchanged.

The firm must keep a record of the results and give the regulator a copy. Version 5 set the timing as “by 31 July 2021 and every 2 years thereafter”. Version 6 replaces that with “by such time, as the Regulator may specify by notice published on an approved website”.

Change 4: a new rule on reporting about policies

Version 6 inserts rule 2.1.4A, Regulatory reporting on policies etc. Its first subrule says:

> “A firm must give the Regulator any reports, documents or other information > relating to the firm’s compliance with these rules as the Regulator may > require, including reports, documents or other information about the firm’s > AML/CFT policies, procedures, systems and controls.”

The form and timing are again whatever the regulator specifies by notice published on an approved website. The rule states that it is in addition to the reports required under rules 2.3.9 (2) and 2.3.10.

In my reading, the practical point is that the rule gives the QFCRA a standing basis in the AML/CFTR to ask for policy documents and compliance information, in a form and by a time it specifies by notice. It sits next to rule 2.1.4, which already requires a firm to carry out regular assessments of the adequacy of its AML/CFT policies, procedures, systems and controls and to review their effectiveness at least annually.

Change 5: who the AML/CFTR apply to

Rule 1.1.4 was substituted. Version 5 applied the rules to firms conducting business or activities in or from “this jurisdiction”, with firms covered by the general insurance rules (AMLG) excluded. Version 6 applies them to a firm that carries on business activities in or from the QFC, other than:

a firm to which the AMLG applies; or
a wholesale advisory firm.

The AMLG are the separate Anti-Money Laundering and Combating the Financing of Terrorism (General Insurance) Rules 2019. A note in the INMA amending instrument says they apply to a firm that conducts only general insurance business and/or insurance mediation for general insurance contracts and non-investment insurance contracts. The REPO and Miscellaneous Amendments Rules 2026 made the same reporting changes in the AMLG as in the AML/CFTR: the review record, new rule 2.1.4A, and the dates for the MLRO’s annual report and for the report from a firm with a non-resident MLRO, all now set by notice.

A wholesale advisory firm is defined in the Investment Management and Advisory Rules (INMA), rule 9C.1.2 (1). It is an advisory firm that is a branch, has or is applying for an authorisation to conduct a regulated activity, and has customers only of these types: high-asset companies; state-owned enterprises; governments or government agencies; state investment bodies; bodies managing public debt; central banks or other national monetary authorities; and supranational organisations whose members are states, central banks or other national monetary authorities.

Leaving the AML/CFTR does not leave such a firm without AML/CFT rules. INMA Part 9C.8 gives wholesale advisory firms their own, shorter set:

seven AML/CFT principles, including a risk-based approach and knowing each customer to the extent appropriate for the customer’s risk profile;
a written AML/CFT policy that sets out how the firm will comply with the AML/CFT Law (Law No. (20) of 2019) and Part 9C.8, including procedures for detecting, reporting and keeping records of suspicious transactions. A firm may use its head office’s policy if it satisfies these requirements;
an AML/CFT training programme, which may be the head office’s programme if appropriate for the firm;
records of each suspicious transaction report made to the Financial Intelligence Unit, kept by the MLRO, and records under the AML/CFT Law or Part 9C.8 kept for at least 10 years after the day each record is made; and
an annual report to the regulator, in an approved form, before the date the regulator specifies in a notice published on an approved website.

The MLRO function of a wholesale advisory firm is a controlled function, and the firm must have an approved individual for it (INMA rule 9C.2.6).

What did not change

The amending instruments’ AML/CFTR schedules touch only chapters 1 and 2: application, the programme and review record, the new reporting rule, wording in the senior management guidance and the MLRO rules, and the two reporting dates. The risk-based approach, CDD, reporting and tipping-off, screening and training, and record-keeping chapters were not amended by these instruments.

Three things worth doing

Take 1 June out of the compliance calendar. Replace it with a check of the QFCRA’s approved website for the notice that sets the date for the MLRO report and senior management’s confirmation, and, if your MLRO is non-resident, for the rule 2.3.10 report. In my view, firms should also confirm with the QFCRA which date applied to the 2025 report, since Version 6 took effect one month before the old 1 June deadline.
Be ready for a rule 2.1.4A request. Keep a current, version-controlled set of AML/CFT policies, procedures and the latest annual effectiveness review under rule 2.1.4, so a request for documents can be answered in the form and by the time the notice sets.
Branches advising only wholesale customers: re-map your obligations. If you meet the INMA definition, your AML/CFT rules are now in INMA Part 9C.8, not the AML/CFTR. If you rely on head office’s policy or training, document why it satisfies Part 9C.8, and check that your customer base stays within the listed wholesale customer types.

Sources

This article draws on the following sources. Follow the links for the original text.

For information only. This briefing is not legal advice: check the cited sources and take advice on your own position.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator qatar