Algeria’s AML Rulebook for Banks: Regulation 24-03 and Transaction Monitoring for New Tech

The Regulation That Anchored Algeria’s Grey-List Exit

When the Financial Action Task Force (FATF) removed Algeria from its list of jurisdictions under increased monitoring on 19 June 2026, the headline was the exit. The substance was the rulebook that made it possible. At the centre sits Regulation No. 24-03, issued by the Bank of Algeria in August 2024, which set out how banks, Algeria Post, and virtual-asset providers must identify customers, monitor transactions, and adapt their controls as financial technology evolves.

The timeline tells the story of a focused programme. According to the Atlantic Council’s analysis of Algeria’s financial reforms, Algeria was added to the grey list in October 2024 and removed in June 2026 — less than 20 months, where Morocco’s comparable delisting took roughly two years. The same analysis cites an IMF study finding that capital inflows decline on average by 7.6 percent of GDP when a country is grey-listed, which frames the stakes precisely: a clean rulebook is not a paperwork exercise but a direct lever on the cost and availability of cross-border finance.

For Algerian banks, payment institutions, and the fintechs building on top of them, Regulation 24-03 is now the reference text. Understanding what it actually requires — and treating it as a foundation to build on rather than a checklist to survive — is the practical work of 2026 and beyond.

What Regulation 24-03 Actually Requires

Regulation 24-03 codifies a risk-based approach: institutions are expected to calibrate the intensity of their controls to the risk a given customer, product, or channel presents, rather than applying identical procedures to everyone. According to Vove’s 2025 guide to AML compliance in Algeria, the regulation requires risk-based customer due diligence (CDD), ongoing transaction monitoring, verification of ownership structures, and specific controls around digital assets — explicitly covering banks, Algeria Post, and virtual-asset providers.

Three obligations carry the most operational weight. First, transaction monitoring must be continuous, not a one-time check at onboarding: institutions screen activity against expected customer behaviour and flag anomalies for review. Second, customer records must be retained for at least five years, giving the Financial Intelligence Processing Unit (CTRF) a usable evidence trail. Third, suspicious activity must be reported to the CTRF, the unit under the Ministry of Finance that receives and investigates these filings.

Crucially, the regulation requires controls to adapt to new technologies. That clause is what makes 24-03 durable. As payment rails, mobile wallets, and digital onboarding evolve, the monitoring logic is expected to evolve with them — the rule is written to outlast any single product generation. The penalty framework backs this up: under the amended AML law, reported fines reach up to DZD 10 million for non-compliance.

The Wider Framework Around 24-03

Regulation 24-03 does not stand alone. It sits on top of Law No. 05-01 (2005), Algeria’s foundational AML/CFT statute, which was substantially overhauled by Law 25-10 in July 2025. Around the same period, the Bank of Algeria codified unified know-your-customer rules through Instruction 04-2025, and a public beneficial-ownership registry went live at the National Commercial Registry Center — a direct response to the FATF priority of making ownership information transparent and accessible.

The FATF itself credited exactly these building blocks. In its June 2026 outcome, the task force recognised that Algeria had strengthened risk-based supervision of higher-risk sectors, developed an effective framework for beneficial-ownership information, enhanced its suspicious-transaction-reporting regime, built targeted financial sanctions for terrorism financing, and applied a risk-based approach to oversight of non-profit organisations. The on-site visit, as coverage of the June 2026 FATF plenary noted, confirmed these were “operational realities,” not just legal text.

On digital assets, the context is specific to Algeria: Law 25-10 of July 2025 prohibits cryptocurrency activity, so the “virtual-asset provider” coverage in 24-03 functions primarily as a monitoring-and-detection mandate — institutions must be able to spot and report digital-asset exposure rather than license it. This matters for fintechs designing controls: the obligation is to detect, not to onboard.

What Algerian banks and fintechs should do

Regulation 24-03 rewards institutions that treat compliance as architecture rather than as a department. Here is how to build on the foundation it provides.

1. Map your transaction flows against a documented risk model before tuning any alerts

Start by classifying customers, products, and channels into risk tiers and writing the rationale down — the regulation’s risk-based approach assumes you can justify why a corporate trade-finance client and a basic Algerie Poste account get different scrutiny. Do not buy a monitoring engine and tune thresholds first; the thresholds mean nothing without the risk model behind them. The Bank of Algeria’s supervision, which FATF credited for adopting risk assessments and supervision manuals, is increasingly looking for that documented logic, not just alert volumes. Build the risk register first, then configure detection on top of it.

2. Make transaction monitoring continuous and tie every alert to a five-year evidence trail

The five-year retention rule is not a storage requirement — it is the backbone of a defensible audit. Structure your systems so that each flagged transaction, the analyst decision, and the supporting documents are linked and retrievable for the full retention window. Avoid the common failure of monitoring at onboarding and then going quiet; 24-03 expects ongoing scrutiny against expected behaviour. A clean, queryable trail is what turns a CTRF inquiry from a fire drill into a routine export.

3. Wire the CTRF suspicious-transaction-reporting path into your workflow, not your inbox

Treat reporting to the CTRF as a first-class process with named owners, service-level targets, and quality checks — not an ad-hoc email when something looks wrong. FATF specifically credited Algeria for enhancing its suspicious-transaction-reporting regime, which means supervisors will expect filings that are timely, complete, and consistent. Designate a money-laundering reporting officer, define what triggers a filing, and rehearse the path so that a real alert moves from detection to CTRF submission without improvisation.

4. Design your controls to absorb new technology, because the regulation assumes you will

The “adapt to new technologies” clause means your monitoring logic should be modular enough to extend to new wallets, payment rails, and onboarding methods without a rebuild. Build a control framework where detection rules are configuration, not hard-coded product assumptions. For digital assets specifically, remember the Algerian context: under Law 25-10 the mandate is detection and reporting of crypto exposure, not licensing — so your rules should flag and escalate, not facilitate. Institutions that bake adaptability in now avoid re-engineering every time the product mix shifts.

The Structural Lesson

Algeria’s grey-list exit in under 20 months is the visible outcome; Regulation 24-03 is the part that endures. The lesson for the financial sector is that a single, well-drafted rulebook — risk-based, technology-neutral, and backed by a real intelligence unit and a beneficial-ownership registry — does more than satisfy an international assessor. It lowers the friction that grey listing imposes on every cross-border transaction, the friction the IMF measures at an average 7.6 percent of GDP in lost capital inflows. The European Commission had mirrored the FATF listing in June 2025, disrupting financial ties Algeria was building with European partners; the delisting reopens those channels.

For banks, Algeria Post, and the fintech layer growing around them, the strategic read is to internalise 24-03 as the baseline for product design rather than a compliance overlay bolted on after launch. The institutions that build monitoring, retention, and reporting into their architecture from day one will find every future product faster to ship and every supervisory review easier to pass. The rulebook that helped Algeria off the grey list is also the one that makes the next generation of digital finance defensible — and that is the more valuable outcome.

Frequently Asked Questions

Sources & Further Reading

• Algeria’s Financial Reforms Are Showing Progress — Atlantic Council
• AML Compliance in Algeria: A 2025 Guide for Fintechs and Regulated Businesses — Vove
• FATF Grey List June 2026: Iraq & Bosnia Added, Algeria Removed — Zigram
• Algeria AML/KYC Compliance Country Guide — Didit
• Outcomes FATF Plenary, 17-19 June 2026 — FATF