A correspondent bank suspending a relationship, a European partner asking for your anti-corruption policies, an inspector requesting evidence of your controls: at such moments, one question confronts every executive. Who, within the company, is responsible for ensuring that rules are known, applied and verified? The answer is the compliance function, which in Algeria is still too often reduced to a job title without resources or a clear mandate.
With the AML/CFT reform driven by Laws No. 23-01 and No. 25-10, Law No. 25-11 on personal data and a removal from the FATF grey list that must now be consolidated, regulatory compliance has become a governance issue. This guide gives you the keys to building a credible function: missions, scope, positioning, organisation, tools and set-up steps, drawing on our experience in Algeria, Europe and the Gulf.
The compliance function aims to prevent non-compliance risk, that is, the risk of judicial, administrative or disciplinary sanctions, financial loss or reputational damage resulting from failure to comply with laws, regulations, professional standards or the company's ethical commitments. It does not replace operational staff, who remain accountable for their actions, but it gives them the framework, tools and oversight they need.
An effective compliance function does more than tick boxes. It spreads a culture of business ethics, protects the company's reputation and eases access to financing and international partners, who increasingly scrutinise the quality of their counterparties' frameworks.
The scope depends on the company's sector and exposure, but four building blocks almost always appear.
For entities subject to Law No. 05-01 of 6 February 2005, as amended, this is the core of the framework: risk-based approach, customer due diligence, enhanced due diligence, suspicious transaction reports to the CTRF, asset freezing. Law No. 25-10 of 24 July 2025 also requires a national and sectoral risk assessment shared with obliged entities, which should feed into your own analysis. Our guide to AML/CFT compliance in Algeria sets out these obligations in detail.
Law No. 06-01 of 20 February 2006 on the prevention of and fight against corruption sets the framework: conflicts of interest, gifts and hospitality, dealings with public officials, third-party due diligence. The High Authority for Transparency, Prevention and Fight against Corruption, enshrined in the 2020 Constitution and organised by Law No. 22-08 of 5 May 2022, is responsible for drawing up and monitoring the national strategy in this area.
Law No. 25-11 on personal data protection, published in Official Journal No. 48 of 2025, requires companies to map their processing activities, secure data and respect data subjects' rights. On top of this come each sector's own rules: the Bank of Algeria for banks and financial institutions, COSOB for financial markets, and the insurance or telecoms regulators.
Bank of Algeria Regulation No. 11-08 of 28 November 2011 on the internal control of banks and financial institutions requires a framework for controlling non-compliance risk and the appointment of an officer responsible for ensuring its consistency and effectiveness. It also requires internal control documentation to describe the rules guaranteeing the independence of control arrangements. For other sectors, this text is a useful benchmark of good practice.
In our engagements in the Gulf, we have often seen regulators judge independence on concrete facts: who sets the compliance officer's pay, who can dismiss them, were their alerts acted upon? A flattering organisation chart is not enough.
| Line | Players | Role in compliance |
|---|---|---|
| First | Operational staff, branches, procurement, sales | Apply the rules and perform first-level controls |
| Second | Compliance, risk management | Set the framework, advise, monitor and control |
| Third | Internal audit | Independently assess the effectiveness of the whole system |
A common mistake is to have compliance perform first-level controls, or even operational tasks such as entering KYC files. The function then loses its detachment and can no longer control what it produces itself.
A dedicated compliance department is essential, often organised into units: financial crime (AML/CFT, sanctions), regulatory compliance and professional ethics, data protection, and ongoing control. In a group, a central head sets the standards and relies on correspondents in subsidiaries or regions. A compliance committee, chaired by senior management, rules on sensitive matters.
The principle of proportionality applies. The function can be entrusted to an existing manager, such as the legal counsel or chief financial officer, provided the mission is written down, real time is allocated to it and they have direct access to the chief executive. Occasional external support, for risk mapping or training, usefully compensates for the lack of a dedicated team.
Whatever the company's size, a few tools are indispensable:
A good board report fits into a few pages: key risks, incidents, progress on the action plan, control results and resource needs. It should enable directors to make decisions, not merely be informed.
The ideal profile combines a solid legal and regulatory background, an understanding of the company's businesses, risk analysis skills and, above all, personal qualities: the courage to say no, a talent for explaining, integrity and diplomacy. Continuous training is essential, given how quickly the Algerian framework is evolving.
Before recruiting or drafting procedures, measure what already exists. A compliance assessment lists the applicable obligations, evaluates the maturity of the framework and identifies priority gaps.
A compliance charter, approved by the board, defines the function's missions, reporting line, investigative powers and reporting arrangements. It protects the compliance officer and clarifies everyone's expectations.
Risk mapping, policies, procedures, training, controls and a whistleblowing channel form the backbone of the compliance programme. It must be proportionate to actual risks, not copied from an international group.
Training for all employees, supplemented by targeted sessions for exposed functions, builds the right reflexes. The message from senior management is decisive: without leadership by example at the top, no framework holds.
The first controls reveal gaps between rules and practice. Simple indicators, tracked over time, make it possible to demonstrate progress to the board and the supervisor, and then to adjust the framework.
For exposed companies in Algeria, structuring a compliance function is no longer optional: it is the condition for demonstrable regulatory compliance, a constructive relationship with supervisors and lasting international partnerships. A well-positioned function, with a clear mandate, proportionate resources and direct access to the board, turns a constraint into a competitive advantage. Start by measuring your starting point, set realistic priorities and commit to the long term: that is how a strong culture of business ethics is built.