On April 14, 2026, Bill 6593 passed its third reading. It contains the Comprehensive Law Against Money Laundering or Other Assets and the Financing of Terrorism (hereinafter the “Comprehensive AML Law”) which was proposed by the Executive Branch in July 2025 and through which the Law Against Money Laundering or Other Assets, Decree 67-2001 of Congress and its amendments, and the Law to Prevent and Suppress the Financing of Terrorism, Decree 58-2005 of Congress and its amendments, will be consolidated into a single body of law.
The Comprehensive AML Law consists of 126 articles that implement the 40 recommendations of the Financial Action Task Force (FATF), so that upon its entry into force, it not only updates the legal framework to prevent and eradicate money laundering—repealing current laws and amending other existing regulations—but also prevents Guatemala from being placed on the international financial system’s gray list.
The Comprehensive AML Law updates and expands the regime of Obligated Persons, as it includes new activities that, by their nature, pose a greater risk of money laundering or other asset laundering and terrorist financing; and consequently, it moves away from the current scheme of requiring uniform controls and adopts the risk-based approach promoted by the FATF recommendations, meaning that each Obligated Person must identify, assess, and manage its own risks, based on the profile of its customers, products, channels, and jurisdiction.
Among the new activities whose performance requires the individual or legal entity carrying them out to register as a Regulated Entity with the Special Verification Authority (IVE) are financial activities (not subject to supervision by the Superintendency of Banks (“SIB”)), commercial activities, or service activities, including, among others, those related to the transfer of funds by electronic means, the granting of loans in any form and for any purpose, and the provision of virtual asset services.
The Comprehensive AML Law recognizes and, for the first time in the country, regulates several Fintech sectors as Obligated Entities (i.e., credit providers, payment gateways, e-wallets, and cryptocurrency service providers). Consequently, customer due diligence (“KYC”) ceases to be merely a best practice. It becomes a legal obligation to be fulfilled before the IVE, in accordance with the Comprehensive AML Law and its respective regulations, as well as registration as a Regulated Entity with said authority.
The Comprehensive AML Law even defines “Customer Due Diligence” as the analysis process conducted in accordance with the set of rules, policies, procedures, and controls, as well as any general or specific measures, that enable Obligated Entities to identify, ascertain, and verify the identity of their customers, those acting on their behalf, and the customers’ ultimate beneficiaries, the purpose of the business relationship, as well as the routine or occasional transactions or operations they carry out.
It is also worth noting the use and even the definition and differentiation between the terms “Ultimate Beneficiary” (the natural person who ultimately controls or benefits from a legal entity or legal structure) and “Customer” (an individual, legal entity, or legal structure with legal personality, with whom a business relationship is established, maintained, or has been maintained), which reinforces the law’s focus on implementing processes, manuals, and complying with reporting requirements for the identification and management of AML/CFT risks for each Obligated Person.
In Guatemala, most Fintech companies already have KYC processes in place for onboarding their clients, some more robust than others; however, the key point is that the entry into force of the Comprehensive AML Law should not negatively or substantially impact their business models, but it will require modifications to their internal processes and the information they must obtain not only from their customers but also from their suppliers, such that they will be obligated as Obligated Entities to comply with at least the following:
- Appoint a compliance officer, who will serve as the liaison with the IVE.
- Implement AML/FT compliance programs.
- Identify beneficial owners in all customer due diligence procedures.
- File suspicious transaction reports.
- Implement policies for the continuous monitoring of transactions, among others.
The challenge for Fintechs will be to demonstrate to the IVE that their risk identification and management are robust through the development and implementation of risk matrices, know-your-customer policies, and properly documented monitoring systems.
The Comprehensive AML Law grants the IVE greater supervisory and enforcement powers to inspect compliance with the obligations imposed on Fintechs registered as Obligated Entities. Therefore, we recommend that Fintechs immediately begin the process of adapting to and implementing the requirements of the law in order to be prepared when it takes effect.
In conclusion, the imminent entry into force of the Comprehensive AML Law not only eliminates the risk of Guatemala being placed on the gray list and improves the country’s risk profile but will also bring benefits for international investors and legal certainty for Fintechs already operating in the country and those wishing to enter our growing Fintech ecosystem, particularly for virtual asset service providers.