🇪🇨 Ecuador · UAFE · Executive Decree 298
AML in Ecuador: a new law, a 2026 regulation and the UAFE
If you work in real estate brokerage, construction, the sale of vehicles or of precious metals and stones, or you are a lawyer or accountant carrying out certain transactions for clients, Ecuador's AML law makes you an obligated party before the UAFE. COX gives you the day-to-day structure: due diligence files, restrictive list and PEP screening, a risk matrix and the audit trail of every decision.
Regulatory framework of reference
- Organic Law on the Prevention, Detection and Combating of Money Laundering: published on 29 July 2024; it repealed the 2016 AML law and took effect one year after publication
- Executive Decree 298: the General Regulation of the law, published on 2 February 2026
- UAFE: receives the reports and grants the registration code; it supervises the non-financial obligated parties that have no specific supervisor
- Superintendency of Companies, Securities and Insurance: supervises the legal entities in real estate, construction, vehicles and precious metals or stones
- Internal Revenue Service (SRI): keeps the register of the beneficial owners of legal entities
A new law and a 2026 regulation
The Organic Law on the Prevention, Detection and Combating of Money Laundering and the Financing of Other Crimes was published in the Official Register on 29 July 2024, repealed the 2016 AML law and took effect one year after publication. Its General Regulation, Executive Decree 298, was published in the Official Register on 2 February 2026 and repealed the previous regulation.
The regulation set deadlines for everyone: for the UAFE, to issue the minimum reference list of politically exposed persons and its guides; for the supervisory bodies, to update their secondary rules; and for compliance officers, to put a risk management methodology in place within sixty days of its publication. That last deadline has already passed. If your programme still cites the 2016 law, it cites a repealed law.
Are you an obligated party?
Article 28 of the law treats as non-financial obligated parties the natural or legal persons carrying out, among others, these activities:
- Real estate development, investment and brokerage
- Construction
- Sale of vehicles, machinery, vessels, ships and aircraft, and armouring of goods
- Trade in precious metals or precious stones
- Notaries, property registrars and commercial registrars
- Lawyers and accountants, in the transactions the law lists
- Company and trust service providers
- Foundations and non-profit organisations
- Political organisations and professional football clubs in Series A and B
For lawyers and accountants the duty is triggered when they carry out, or prepare to carry out, transactions for clients involving the purchase and sale of property, managing money, securities or other assets, managing accounts, organising contributions to create or run companies, and creating, operating or managing legal entities or buying and selling commercial entities. The UAFE may add or remove obligated parties by reasoned resolution.
Who supervises you?
The UAFE, the Financial and Economic Analysis Unit, is the technical body that receives reports and grants the registration code, and it sanctions breaches relating to that code and to reporting. Supervision, however, is split by sector under Article 65 of the law.
Legal entities engaged in real estate investment and brokerage, construction, the sale of vehicles, machinery, vessels, ships and aircraft, and the trade in precious metals or stones are under the Superintendency of Companies, Securities and Insurance. Notaries answer to the Judiciary Council, and property and commercial registrars to the National Directorate of Public Registries. The UAFE supervises non-financial obligated parties that have no specific supervisor.
Your concrete duties
Registration code
Apply for the registration code with the UAFE and keep your details current: any change is reported within fifteen days at most. The regulation gives thirty days to obtain it once the reportable activity appears in the taxpayer register (RUC).
Compliance officer
Appoint a principal compliance officer and an alternate. The regulation requires the officer to pass the course the UAFE teaches, and the officer is the link between the obligated party, the UAFE and its supervisor.
Prevention programme and manual
A programme suited to your activity, size and complexity, with due diligence policies, ongoing training, record keeping and whistleblowing channels, set out in a Prevention Manual registered with your supervisory body.
Risk matrix
A methodology with high, medium and low risk categories covering at least clients, products or services, geographic areas, distribution channels and transaction activity, updated at least once a year.
Due diligence
Identify and verify the client or supplier, whoever acts on their behalf and the beneficial owner, understand the purpose of the relationship and the source of funds, and monitor it on an ongoing basis. If you cannot complete it, you do not start the relationship; if it already started, you end it and report to the UAFE.
Suspicious operation report
File the ROS with the UAFE within five days of becoming aware of the operation, completed or attempted, whatever its amount.
Threshold report
Within the first fifteen days of each month, report individual transactions of ten thousand dollars or more, and multiple transactions that together reach that amount for the benefit of the same person within one month.
Nil return
If there was nothing to report in the month, record that in the UAFE system within ten days after the month ends.
Record keeping
Retain the information for ten years after the contractual relationship ends or after the last transaction.
How COX solves it
Digital due diligence file
Every client, natural person or company, with identification, documents, beneficial owners, assigned risk and a full record of who reviewed what, and when.
Restrictive list screening
Screening against the United Nations Security Council consolidated list, the OFAC lists and other international sources, with evidence of every check.
PEP detection
A record of the politically exposed status of the client and of the people linked to them, with the enhanced due diligence workflow.
Adverse media
Negative news searches on the client, filed within the record.
Risk matrix
Classification by client, activity, geography and channel, with the documented methodology and the validity period of every assessment.
Digital onboarding
Clients complete the form and upload documents from their phone. You receive a finished, validated file.
Recorded training
A record of your staff's training, with its certificate and validity, to show your supervisor that it exists.
Whistleblower channel
A channel to receive reports, anonymous ones included, and follow up each case until it is closed.
Audit trail for your supervisor
An immutable record of every decision. That is the difference between standing behind a file and rebuilding it when someone asks for it.
What COX does not do for you
COX does not currently generate the UAFE report files or file reports on your behalf: the ROS, the threshold report and the nil return are filed in the UAFE system, in the format the UAFE defines. Nor does it screen against Ecuadorian lists.
What COX gives you is the file, the list screening, the risk matrix and the evidence behind each of those reports.
Non-compliance has a price
The law classifies breaches as minor, serious and very serious. Minor breaches carry a fine of one to ten unified basic wages, serious ones eleven to twenty, and very serious ones twenty-one to forty.
Serious breaches include failing to appoint a compliance officer, failing to apply due diligence and filing the threshold report or the nil return late. Very serious ones include operating without a registration code, failing to report suspicious operations, failing to keep records for ten years and filing an incomplete or wrong threshold report.
For obligated parties sanctioned by the superintendencies, the sanctions of the Organic Monetary and Financial Code apply, and those of this law only where there is no specific one.
Why COX
Live in days
No installation, no long project. You start building files the same day.
Built for practices and mid-sized companies
Not a banking platform in disguise. Built for the volume and budget of a law firm, a real estate agency or a developer.
Pay as you go
No forced monthly fee. You pay for the clients you screen.
data encryption · immutable audit log · role-based access · cloud hosting
Bring your programme up to date with the new regulation
Frequently asked questions
COX also covers these countries:
Panama Mexico: PLD software Mexico: LFPIORPI Colombia Guatemala Dominican Republic Venezuela