What Is Decree 15-2026?
Decree 15-2026, officially titled Ley Integral para la Prevención y Represión del Lavado de Dinero u Otros Activos y del Financiamiento del Terrorismo, was approved by the Congress of the Republic of Guatemala on June 2, 2026, published on June 17, 2026, and entered into force on September 17, 2026.
The new legislation consolidates and updates Guatemala's framework for preventing and combating money laundering and terrorist financing.
It replaces the framework previously set out primarily in Decree 67-2001, Ley Contra el Lavado de Dinero u Otros Activos, and Decree 58-2005, Ley para Prevenir y Reprimir el Financiamiento del Terrorismo.
The new framework also includes provisions addressing the financing of the proliferation of weapons of mass destruction and reinforces a risk-based approach to prevention.
Who Is Affected by Guatemala's New AML Law?
One of the most significant aspects of Decree 15-2026 is the expansion and updating of the regime governing obligated entities.
The law's impact extends beyond the banking system.
Depending on their activities, businesses and professionals in different sectors of the economy may be subject to compliance obligations.
The assessment should therefore go beyond a company's registered corporate purpose. It must consider the activities the organization actually carries out, the services it provides, its clients and the types of transactions it undertakes.
Is Your Business Required to Comply with Decree 15-2026?The answer requires an assessment of the organization's actual activities and the provisions applicable to its sector.
Request an Applicability Assessment → The Risk-Based Approach
The new legislation reinforces a fundamental principle of modern AML systems: controls should reflect each organization's actual risk exposure.
This requires identifying, assessing and understanding risks associated with factors such as clients, products, services, geographical location, delivery channels and the nature of transactions.
Compliance involves more than completing forms.
An organization should be able to demonstrate that it has identified its risks, established reasonable controls and retained evidence that those controls are being applied.
Customer Due Diligence and Know Your Customer (KYC)
Due diligence is a cornerstone of the new framework.
Depending on the level of risk and the applicable obligations, organizations must have procedures that enable them to know their clients adequately and understand the nature of the business relationships they establish.
Relevant elements include:
- identifying and verifying the client's identity
- identifying persons acting on behalf of others
- understanding the purpose of the business relationship
- understanding the client's transaction profile
- identifying higher-risk factors
- determining the beneficial owner where required
- monitoring the relationship in accordance with the identified risk.
A form may be part of a due diligence system, but it cannot replace substantive analysis where complex structures, inconsistencies or red flags are present.
Beneficial Ownership
Transparency in the ownership and control of legal entities and arrangements is particularly important under the new framework.
In certain due diligence processes, identifying the company or entity formally listed as the owner is insufficient.
It may be necessary to understand the ownership and control structure in order to identify the natural person who ultimately owns, controls or benefits from it, in accordance with the criteria established by the applicable legislation.
This analysis is particularly relevant to corporate groups, structures involving foreign companies, holding companies, trusts and transactions with multiple layers of ownership.
Read our related analysis on beneficial ownership, PEPs and due diligence →Politically Exposed Persons (PEPs)
Identifying Politically Exposed Persons (PEPs) is one of the controls that may be necessary within a risk-based preventive system.
PEP status does not, in itself, imply unlawful activity.
It calls for a particular level of risk to be identified and managed appropriately where the applicable provisions require this.
The aim should be to establish procedures capable of identifying these relationships and applying measures proportionate to the risks involved.
The IVE and Regulatory Supervision
The Intendencia de Verificación Especial (IVE), Guatemala's Financial Intelligence Unit, continues to play a central role in the country's system for preventing money laundering and terrorist financing.
The new framework strengthens the system of prevention, analysis, regulatory supervision and compliance.
For organizations subject to preventive obligations, this means that policies must do more than exist on paper.
Procedures, records, assessments and controls should demonstrate that the compliance program operates effectively in practice.
Recordkeeping and Evidence of Compliance
A fundamental element of any preventive program is the ability to demonstrate what has been done.
Identifying a client, assessing a risk or analyzing a transaction without retaining adequate evidence significantly limits an organization's ability to demonstrate compliance.
Records should make it possible to understand what information was obtained, what analysis was performed, what decision was reached and why.
One practical principle remains particularly relevant in compliance:
Complying is not enough. Compliance must also be demonstrable.
