AML Compliance in Jamaica: POCA, Bank of Jamaica and FID Reporting Explained

Listen To Our Podcast🎧

• 1:44

AML Compliance in Jamaica: POCA, Bank of Jamaica and FID Reporting Explained

Secure. Automate. – The FluxForce Podcast

What does AML compliance in Jamaica require?

If you run AML compliance at a Jamaican bank, credit union, cambio or remittance company, three names cover most of your working week. The Proceeds of Crime Act (POCA) sets the money laundering offences and the duty to report. The Bank of Jamaica (BOJ) supervises you against that law and its regulations. The Financial Investigations Division (FID) receives every report you file.

Most of what goes wrong sits in the gaps between them: a suspicion that reaches the nominated officer on day sixteen, a threshold report nobody filed because the month was quiet, or a transfer released while consent was still pending.

This guide is for the nominated officer, the MLRO and the compliance team at an institution the BOJ supervises. It works from the BOJ's 2026 Guidance Notes, published in the Jamaica Gazette on 17 June 2026, the 2019 amendments to the money laundering regulations and the FID's own reporting pages, as they stood on 28 October 2026. It reads those texts practically. It isn't legal advice, and where the Guidance Notes paraphrase a statute, check the section itself with your attorney before you change a procedure.

Request a Caribbean AML program walkthrough

Bring your current AML policy, or one part of it such as the STR clock or the monthly TTR, to a scoped FluxForce Policy and Compliance Management session. We'll show the agent pulling out the rules your policy contains, proposing a control for each one linked to its clause, and flagging clauses with no control behind them, for your compliance team to review. In observation mode the agents work next to your team and don't close, block or file anything.

Talk to us about Caribbean AML requirements

Who supervises AML compliance in Jamaica?

Two public bodies matter most for a financial institution, and they don't overlap much.

• POCA, the TPA and the UNSCRIA set the duties, and the BOJ Guidance Notes explain how the Bank of Jamaica expects them to be met. The BOJ Guidance Notes set the minimum standards each financial institution is examined against. The Bank of Jamaica supervises each financial institution against those duties. Inside the financial institution, staff report suspicions to the nominated officer. The nominated officer files every report with the FID through goAML.

The Bank of Jamaica is the competent authority. That means it supervises the institutions it regulates for compliance with POCA and issues the guidance you are examined against. The BOJ's 2026 Guidance Notes apply to commercial banks, merchant banks, building societies, financial holding companies, credit unions, cambios, licensed microcredit institutions and approved money transfer and remittance agents and agencies.

The Financial Investigations Division is the designated authority. For POCA, the Terrorism Prevention Act and the UN Security Council Resolutions Implementation Act, the designated authority is the head of the FID. That post was called Chief Technical Director until it was retitled Director General from 1 April 2023, and older guidance and forms still use the old title.

The FID's Financial Intelligence Unit receives the reports. Its own page lists suspicious transaction reports, threshold transaction reports, listed entities reports, authorized disclosures and reports of international transportation of currency or bearer negotiable instruments. The FIU also receives consent requests, and the FID has seven working days to respond to them.

The Financial Services Commission (FSC) is also a competent authority under the Terrorism Prevention Act. This guide covers the institutions the BOJ supervises. Firms the FSC supervises report to the FID under the same statutes, but take their supervisory guidance from the FSC.

The first figure shows how the texts and the bodies fit together. POCA, the TPA and the UNSCRIA set the duties, and the BOJ Guidance Notes explain how the Bank of Jamaica expects them to be met. The BOJ Guidance Notes set the minimum standards each financial institution is examined against. The Bank of Jamaica supervises each financial institution against those duties. Inside the financial institution, staff report suspicions to the nominated officer. The nominated officer files every report with the FID through goAML.

If you also cover other markets, our country guides to AML regulators, laws and control expectations set out the same split between supervisor, financial intelligence unit and reporting officer for each jurisdiction we cover.

Which laws make up Jamaica's AML framework?

Jamaica's framework is a stack of statutes, regulations and BOJ guidance. The Guidance Notes list the "applicable legislation" that the BOJ expects you to follow.

POCA came into effect on 30 May 2007 and replaced the Money Laundering Act. Section 92 makes it an offence to engage in a transaction involving criminal property, to conceal, disguise or dispose of it or bring it into Jamaica, or to convert, transfer or remove it from Jamaica. Section 92(2) adds entering into an arrangement that helps someone else acquire, keep, use or control criminal property, and section 93 covers acquiring, using or possessing it. The test is knowledge or reasonable grounds to believe, so wilful blindness is enough for a conviction. Under POCA, any offence in Jamaica can be a predicate offence, which is wider than the repealed Money Laundering Act. A suspicion of tax evasion, bribery or diverted public funds is therefore reportable in the same way as a suspicion of drug money.

What changed in the 2026 Guidance Notes?

The Guidance Notes were first circulated in this form in 2004, updated several times, reissued in April 2017 and last published before this edition in 2018. The 2026 edition is marked "Revised 2025 and 2026" and was published as Government Notice No. 383 in the Jamaica Gazette Extraordinary of 17 June 2026.

The foreword says the revision reflects the 2019 amendments to the AML/CFT/CPF laws and the FATF Recommendations as last updated in December 2025. It also flags sanctionable obligations under the AML/CFT/CPF Rules to be issued under the Banking Services and Bank of Jamaica Acts. For a compliance team, three practical changes stand out.

First, the BOJ now says plainly which failures are breaches of its Supervisory Rules. More than twenty paragraphs end by saying that failing to meet them will constitute a breach of the BOJ's AML/CFT/CPF Supervisory Rules. Read those lines as your examination checklist.

Second, the edition adds guidance for central bank digital currency. Institutions must integrate CBDC wallet activity into their existing transaction monitoring, with thresholds, triggers and typology-based detection tied to STR duties. That matters for any institution handling JAM-DEX, the BOJ's digital currency, alongside ordinary accounts.

Third, an appendix advises licensees on cyber risk, including AI-generated deep fakes used to defeat KYC and remote onboarding. If you onboard customers remotely, your verification controls now need a documented answer to synthetic identities.

Is Jamaica still on the FATF grey list?

No. The FATF placed Jamaica under increased monitoring in February 2020 and removed it at its June 2024 plenary in Singapore, as the Ministry of Finance announced. The Bank of Jamaica said exiting the list should tell correspondent banks that Jamaican transactions no longer need enhanced review.

The removal doesn't close the matter. The Ministry of Finance said in 2024 that Jamaica was preparing for the fifth round of mutual evaluations, then scheduled for mid-2026. It listed virtual assets, non-profit registration and proliferation-related sanctions as areas needing new or amended law. Expect examiners and evaluators to test how well your controls work in practice as well as whether the policies exist.

What must a regulated business do under POCA?

A business in the regulated sector carries a fixed set of duties under POCA and the money laundering regulations. The BOJ groups them as reporting, record keeping, risk assessment, customer due diligence and internal controls. Each one needs evidence an examiner can see.

Start with a written risk profile

Since the 2019 amendments, a regulated business must establish a risk profile for its operations as a whole and for all its business relationships and one-off transactions. It must apply measures that match the risks and can't use simplified due diligence for anything it rates as high risk.

The BOJ adds process requirements on top. The risk assessment must be in writing and submitted to the competent authority within 30 days of Board approval, every three years or more often if the BOJ asks. The methodology, scoring criteria and weights should be documented well enough for internal audit, external audit and the BOJ to test it.

Verify customers within 14 days

You must establish a customer's identity as soon as practicable, and no later than 14 days after contact is first made, for one-off transactions and ongoing relationships alike. If you can't verify within that time, risk management measures apply to the relationship while verification continues.

If you suspect money laundering and believe full due diligence would alert the customer, the Guidance Notes tell you to stop the CDD, record why on file and make the required disclosure. It is one of the few places where the rules ask you to stop checking.

Apply enhanced due diligence to specified territories

Section 94A, added in 2019, requires enhanced due diligence on all relationships and transactions with customers resident, domiciled or incorporated in a specified territory. You must examine the background and purpose of those relationships, set your findings out in writing and make them available on request. A specified territory is one a supervisory authority lists by notice in the Gazette.

Keep records for seven years

POCA requires a regulated business to identify complex, unusual or large transactions and unusual patterns, and to keep a record of them for at least seven years. The Terrorism Prevention (Reporting Entities) Regulations also set a minimum seven-year retention period. Keep your findings with the transaction data, because POCA and the TPA treat both the same way and expect them to be available on request.

Run the program through a manual, training and audit

Your AML policies and procedures must be documented in a manual that relevant staff can access, reviewed at least once a year and approved by the Board. The BOJ treats failure here as a breach of its Supervisory Rules.

Training matters for a legal reason as well. Under POCA, an employee charged with an offence can argue both that they didn't know or suspect, and that their employer never trained them. A training gap therefore weakens your own staff's position and your institution's.

POCA and the TPA both require an independent audit of the compliance program. The BOJ expects external auditors to review it at least annually for institutions with a high-risk audit rating, and every two to five years for moderate to lower ratings.

How does reporting to the FID work?

Every report goes to the FID, which the Guidance Notes call the reception point for disclosures under POCA, the TPA and the UNSCRIA. The Guidance Notes describe goAML as the web portal now used for filing required disclosures. Reporting under the TPA moved to the goAML platform from 1 September 2020.

• A staff member who forms a suspicion has at most fifteen days to bring it to the nominated officer. If the suspicion stands, the nominated officer has at most fifteen days to make the required disclosure. The required disclosure goes to the FID through goAML on the prescribed form. Where the institution needs to proceed, the FID decides on appropriate consent within seven working days. The transaction, the findings and the required disclosure all go to the retained record for at least seven years.

The reporting obligations table below is the part most teams get wrong, so it comes first. The sections after it explain each line.

The second figure shows the suspicious transaction clock. A staff member who forms a suspicion has at most fifteen days to bring it to the nominated officer. If the suspicion stands, the nominated officer has at most fifteen days to make the required disclosure. The required disclosure goes to the FID through goAML on the prescribed form. Where the institution needs to proceed, the FID decides on appropriate consent within seven working days. The transaction, the findings and the required disclosure all go to the retained record for at least seven years.

The STR clock is 15 days plus 15 days

Section 94 of POCA requires a disclosure when you know or believe, or have reasonable grounds to know or believe, that someone has engaged in a transaction that could constitute or be related to money laundering, and the information came to you in the course of business in the regulated sector. The disclosure goes either to your nominated officer or to the designated authority.

The Guidance Notes turn the statute into a clock. The person who forms the suspicion has at most fifteen days to report it to the nominated officer. The nominated officer then has at most fifteen days to file with the FID, which gives a maximum of thirty days from suspicion to filing. The statutory wording is "as soon as is reasonably practicable and in any event within fifteen days", so treat fifteen days as the outer limit and file sooner when you can.

Key insight: the clock runs from the moment a suspicion is formed. Date-stamp that moment in your internal reporting system, because a case opened a week later still carries the earlier date, and that is the date an examiner will count from.

Record the nominated officer's reasons when they decide not to file as well. The BOJ expects each case to be reviewed at that level and the suspicion to be reported unless facts negate it.

Appropriate consent: seven working days, then ten days

POCA sets out a statutory consent regime. After the nominated officer makes a disclosure, you have "appropriate consent" to proceed in three cases:

1. The FID consents within seven days, excluding weekends and public holidays and counting from the day after the disclosure.
2. The FID sends no refusal within those seven days.
3. The FID refuses within the seven days, and ten days have passed since the refusal without further action by the authorities, such as a court order restraining you from dealing with the property.

The FID can give consent or refusal verbally, but must follow up in writing within five days.

The trap is the transaction that can't wait. If you must proceed before consent, the Guidance Notes say you must make the disclosure on your own initiative as soon as reasonably practicable. They also say that doesn't remove the need to seek consent for any further dealing with the customer or the property.

The consent regime belongs to POCA alone. The TPA and the UNSCRIA have no statutory appropriate consent, so the indemnities that come with it don't apply to matters under those Acts. The BOJ suggests agreeing a similar process with the FID for them where the law allows.

Threshold transaction reports: monthly, with nil reports

Regulation 3 of the money laundering regulations requires financial institutions to report cash transactions at or above the prescribed amount to the FID. The report is due within fifteen days after the end of the month, and the duty applies even if there were no such transactions, in which case you file a nil report.

The thresholds are tiered:

• US$15,000 or more, or the equivalent, for financial institutions other than cambios.
• US$8,000 or more for cambios and bureaux de change.
• US$5,000 or more for remittance companies.

An established customer that has banked with you for at least 12 months and runs certain retail, entertainment or hospitality businesses may be exempted by the Minister of Finance for transactions that match its lawful activity. The Minister grants that exemption on application, so your institution can't decide it for itself.

TPA listed-entity reports

The TPA requires you to determine, on a continuing basis, whether you hold or control property owned or controlled by or on behalf of a listed entity. The Terrorism Prevention (Reporting Entities) Regulations prescribe forms for quarterly reports on whether you hold such property.

Cambios and remittance companies don't hold accounts, so most of them file nil reports. The BOJ still expects them to review their transactions, because a cambio holding a customer's money order or cheque could be holding listed-entity property.

Cash limits and cross-border cash

Section 101A of POCA, added in 2013, prohibits a cash transaction above JMD 1 million unless it is carried out with a permitted person, and prohibits splitting one activity into smaller payments to get under the limit. Permitted persons include deposit-taking institutions the BOJ licenses, licensed exchange bureaux and anyone the Minister designates by order. At the exchange rate of 12 September 2025 that the Guidance Notes use, the limit is about USD 6,261. Deposit-taking institutions and cambios can accept larger cash payments, but they must still watch for connected people whose payments each stay under the limit but together exceed it.

Separately, section 101 requires a report when cash or bearer negotiable instruments over US$10,000 are taken into or out of Jamaica, using the FID's standard form.

Tipping off

Section 97 of POCA makes it an offence to disclose that a protected or authorized disclosure has been or will be made, or that an investigation is under way or about to start. The Guidance Notes point out that auditors aren't in the statutory list of people a disclosure can lawfully go to. They expect institutions to limit what internal and external auditors see to what those functions need, on legal advice.

Penalties

The 2019 amendments added fixed penalties for listed breaches of the money laundering regulations. For example, failing to comply with regulation 5(3), the requirement to nominate an employee to run the program, carries a fixed penalty of JMD 2,100,000 for an individual and JMD 3,500,000 for a body corporate.

Failing to file threshold reports can bring a fine of up to JMD 1,000,000 under the regulations as amended in 2019. Under the TPA, breaching the reporting and record duties in sections 15 and 16 can bring a fine of up to JMD 1 million and up to 12 months in prison for an individual, and up to JMD 3 million for a body corporate. For licensees under the Banking Services Act, the BOJ can also treat reporting failures as grounds for remedial action or as an unsafe or unsound practice.

What do cambios and remittance companies need to know?

Cambios and remittance companies sit under the same Guidance Notes, with lower thresholds.

• All cash transactions at or above your tier's threshold feed the monthly threshold transaction report. The threshold transaction report goes to the FID within fifteen days after the end of each month, as a nil report if there were none. The continuing listed-entity check feeds the quarterly TPA listed-entity report. The TPA listed-entity report goes to the FID, and most cambios and remittance companies file it as a nil report. Cross-border cash above USD 10,000 needs a cross-border currency report. The cross-border currency report also goes to the FID on its standard form.

The third figure shows the periodic reports every institution files, whatever its size. All cash transactions at or above your tier's threshold feed the monthly threshold transaction report. The threshold transaction report goes to the FID within fifteen days after the end of each month, as a nil report if there were none. The continuing listed-entity check feeds the quarterly TPA listed-entity report. The TPA listed-entity report goes to the FID, and most cambios and remittance companies file it as a nil report. Cross-border cash above USD 10,000 needs a cross-border currency report. The cross-border currency report also goes to the FID on its standard form.

Since the 2019 amendments, any institution conducting wire transfers must identify and verify the recipient of transfers above US$500. It must also keep accurate information on the transfer throughout the payment chain, and have risk-based policies for deciding whether to execute, reject or suspend a transfer when that identification hasn't been made.

For cambio and remittance transactions of US$500 or more, the Guidance Notes require copies of identification and source-of-funds documents. Electronic transfers above that amount must also carry the national identification number, the customer identification number and the originator's date and place of birth.

The red flags the BOJ lists for transfers will be familiar to anyone working a remittance queue. They include transfers to countries the customer has no apparent connection with, transfers to one person from many senders or from one sender to many people, and transfers without complete originator information.

What does the nominated officer decide?

The nominated officer is the person POCA and the TPA hold to the reporting deadlines, and the BOJ is specific about who that should be.

• The risk profile shapes the policy manual, because the policies must be informed by your assessment of risk. The risk profile goes to the Board for approval, and the approved assessment goes to the Bank of Jamaica within 30 days. The policy manual goes to the Board for approval at least once a year. The policy manual then drives the controls staff run every day. Results from the controls feed the nominated officer report to the Board at least once a year. The nominated officer report goes back to the Board and into the next risk profile.

A financial institution must name an employee who performs management functions as its nominated officer. The BOJ says the role works best when it is senior enough to report to the Board, aware of the AML/CFT/CPF laws, able to monitor compliance across the institution and independent of the business lines. That officer reports to the FID, advises staff on spotting suspicious transactions and should follow the FID's advisories on reporting.

At least once a year, the nominated officer must report to the Board. The minimum content is long. It includes the effectiveness of the AML/CFT/CPF framework, risk assessment results, the number and frequency of threshold reports and required disclosures, and trends in what was reported. It also covers CDD compliance, audit and BOJ examination findings, training and upcoming legal changes.

The fourth figure shows how the risk assessment and the Board connect. The risk profile shapes the policy manual, because the policies must be informed by your assessment of risk. The risk profile goes to the Board for approval, and the approved assessment goes to the Bank of Jamaica within 30 days. The policy manual goes to the Board for approval at least once a year. The policy manual then drives the controls staff run every day. Results from the controls feed the nominated officer report to the Board at least once a year. The nominated officer report goes back to the Board and into the next risk profile.

Who decides what when AI agents are part of the system?

AI agents can take on much of the preparation work behind each of those steps. They shouldn't take the decisions the law gives to people, and in Jamaica those decisions sit with named humans.

• The monitoring and screening systems send each alert to the AI agent layer, which gathers the transactions, customer history and counterparties. The AI agent layer sends each case to the analyst with its proposed disposition and reasoning. The AI agent layer also writes every step and data version to the audit trail. The analyst escalates suspicious cases to the nominated officer. The nominated officer decides on the goAML report, and that decision and its reasons go to the audit trail.

The fifth figure shows the same split. The monitoring and screening systems send each alert to the AI agent layer, which gathers the transactions, customer history and counterparties. The AI agent layer sends each case to the analyst with its proposed disposition and reasoning. The AI agent layer also writes every step and data version to the audit trail. The analyst escalates suspicious cases to the nominated officer. The nominated officer decides on the goAML report, and that decision and its reasons go to the audit trail.

Following the FATF, the Guidance Notes say the risks of new payment products, services and mechanisms should be assessed before launch, while they are still in the project phase. Treat an AI component in your monitoring or reporting process the same way, and document the assessment before it touches a live case.

Conclusion

Jamaica's AML regime is demanding but predictable. POCA and the TPA fix the clocks, the money laundering regulations fix the thresholds, and the BOJ's 2026 Guidance Notes tell you what an examiner will ask to see. For a nominated officer, the work is making each of those dates and thresholds into a control with a record behind it. If you are building or refreshing that program, the AML program charter template sets out the governance document, and our guide to AML compliance covers what banks must build and prove.

Request a Caribbean AML program walkthrough

Bring your current AML policy, or one part of it such as the STR clock or the monthly TTR, to a scoped FluxForce Policy and Compliance Management session. We'll show the agent pulling out the rules your policy contains, proposing a control for each one linked to its clause, and flagging clauses with no control behind them, for your compliance team to review. In observation mode the agents work next to your team and don't close, block or file anything.

Talk to us about Caribbean AML requirements

Frequently Asked Questions

About the author

Sahil Kataria

Founder and CEO of FluxForce

Sahil works on secure AI and financial technology for regulated industries. His engineering background spans identity verification, payment security and compliance automation. He has led teams across Africa, the United States, Europe and India.

At FluxForce.ai, his focus is on explainable AI and auditable financial workflows. He writes for banking and compliance teams about the practical decisions behind these systems: how to assess risk, keep controls visible and introduce automation without losing accountability.

View Sahil Kataria author profile →