Skip to content

AML & KYC

What we ask,
why, and what we do with it.

Under Law 308/2017 on the prevention and combating of money laundering and terrorism financing, advisory firms in Moldova must identify clients, assess risk, monitor relationships, and report suspicious activity to SPCSB. The page below describes the cycle that any compliant Moldovan advisor will follow on your engagement, in plain language.

Last updated 2026-05-07. Aligned with SPCSB and BNM guidance.

The five-stage cycle

From first contact
to record retention.

The same cycle applies to every engagement, scaled to risk. Standard for most founders. Enhanced for higher-risk profiles. Simplified for low-risk, narrow scopes.

  1. 01

    Onboarding

    Before any engagement letter is signed, the natural persons behind the contract are identified: founders above 25%, directors, ultimate beneficial owners. The standard set is a scanned passport, a recent proof of address, and a short source-of-funds note. For corporate counterparts, the certificate of incorporation, the register of shareholders traced to UBO, and good-standing evidence.

  2. 02

    Risk classification

    Each engagement is assessed against a documented risk matrix: nationality and tax residency, source of funds, business activity, geography, and politically exposed person status. The classification sets the level of due diligence: standard, enhanced, or simplified, and is reviewed annually.

  3. 03

    Ongoing monitoring

    For active engagements a periodic review cycle is maintained. Material changes in ownership, activity, or jurisdiction trigger re-verification. Transactions that depart from the established pattern are reviewed before they are facilitated.

  4. 04

    Reporting

    Where Moldovan law requires it, suspicious-transaction or unusual-activity reports are submitted to SPCSB (Serviciul Prevenirea și Combaterea Spălării Banilor), the Moldovan AML supervisor. The client is not notified about a report, in line with the tipping-off prohibition under Law 308/2017.

  5. 05

    Records

    Identification documents, risk assessments, and engagement files are retained for the period required by Law 308/2017, currently five years from the end of the engagement. Records are stored encrypted, accessed on a need-to-know basis, and never shared with marketing or third-party processors outside the lawful chain.

What we collect

By profile.

The exact list is confirmed in your engagement letter. Items below are the standard set. Your specific case may need fewer or, for higher-risk profiles, additional items.

Individual founders

  • Scanned passport or national ID, all relevant pages.
  • Proof of address dated within 90 days (utility bill or bank statement).
  • Source-of-funds note describing where the working capital comes from.
  • Short business-activity description (CAEM activity codes where known).
  • Politically exposed person self-declaration.

Corporate shareholders

  • Certificate of incorporation, dated within six months.
  • Certificate of good standing or equivalent.
  • Memorandum and articles of association.
  • Register of shareholders, traced to ultimate natural-person beneficial owners.
  • Director identification documents (passports, address proofs).
  • Last two years of audited or management accounts where available.

Higher-risk profiles

  • Enhanced source-of-funds documentation, including bank statements and supporting evidence.
  • Reference letter from an existing professional advisor or banking relationship.
  • Where applicable, evidence of regulatory licensing or registration in the home jurisdiction.
  • Detailed business plan and expected transaction profile.

Your rights and obligations

What you can ask,
what we cannot tell you.

You may ask, at any time, what data is held about you, why it is held, and the legal basis. The Privacy Policy at /en/privacy-policy/ sets out the data-protection rights in detail. Moldova\'s Law 133/2011 on personal data protection is the local framework, aligned with GDPR principles.

Under Law 308/2017, you cannot be informed by your advisor if a suspicious-activity report has been submitted to SPCSB about your file. The tipping-off prohibition applies. If you suspect a report has been made and disagree with the basis, the lawful route is a complaint directly to SPCSB or to ANSPDCP-equivalent on the data-handling aspect.

You are obliged, under the engagement letter and under Moldovan law, to provide accurate information for AML purposes. Knowingly providing false information can constitute a criminal offence and will, in any case, terminate the engagement.

Questions about a specific item we asked for?

Write to info@incorpore.md with the engagement reference. The compliance contact replies within one business day.

Contact compliance