Discretion across a complex transaction.

A superyacht or business jet sale can draw in a buyer’s office, a seller’s company, brokers on both sides, lawyers in several countries, a flag or aircraft registry, surveyors, insurers, escrow agents and banks. Each party needs part of the file. None needs all of it. Discretion here is a set of access rules, written down and enforced.

Why the sector carries formal duties

Monaco’s anti-money laundering law names these markets. Law No. 1.362, article 1, 15° bis lists traders and persons engaged in the sale or rental of aircraft and of large pleasure vessels. Article 23 requires obliged entities to keep due diligence and transaction records for five years, with possible extension. Whether a given intermediary falls within that wording depends on what it does; firms should confirm their status with their compliance officer.

For yachting, the Monegasque Financial Security Authority (AMSF) has published specific guidance. Its presentation of 19 May 2026 states that identification takes place from the prospect stage, that beneficial owners must be identified, meaning anyone holding more than 25% of the capital or voting rights or exercising control by other means, and that remote identification is permitted subject to enhanced due diligence. It observes that most Monaco yachting companies combine activities that bring them within scope. That guidance addresses yachting; aviation firms should read the law itself rather than assume the same scope.

Personal data in both kinds of file also falls under Law No. 1.565.

A data room built around roles

The data room should mirror the deal:

• One workspace per transaction, never a shared drive per broker.
• Folders per party, with access granted to named people and set to expire.
• A separate KYC vault. Identity and ownership documents sit apart from technical and commercial files, visible to compliance staff only.
• Watermarks and view-only modes for surveys, specifications and financial statements.
• An access log showing who opened what, and when.

The Sovereign Ordinance No. 11.327 lists security objectives for sensitive processing that map onto these features: prevent unauthorised use, verify recipients and entries, protect data in transit, and restore systems after interruption.

Minimise what KYC collects and who sees it

Due diligence needs identity, address, ownership structure and screening results. It does not need a passport scan in a broker’s inbox, or a beneficial owner’s details in a marketing list. Article 4 of Law No. 1.565 limits data to what the purpose requires, and article 5 constrains reuse for other purposes. Practical rules:

• collect KYC through a secure upload link, not email;
• store it once and reference it elsewhere;
• restrict it to the compliance function;
• start the five-year clock at the end of the relationship, then delete unless an extension applies.

Source-cited answers across a crowded file

A transaction file can run to thousands of pages: surveys, class records, logbooks, maintenance history, crew contracts, registry and tax documents. A private assistant can answer questions such as ‘when was the last class survey?’ or ‘which warranties transfer?’ Each answer should link to the document and page it relies on, so a broker or lawyer checks the source before acting. The assistant runs inside the transaction’s permissions, so one deal’s file never informs another.

No speculative ownership research

Some tools promise to reveal who owns a vessel or aircraft by merging scraped registries, social posts and leaked data. That route yields weak evidence and builds profiles people never expected. The AMSF asks for identification based on reliable and independent supporting documents. Article 19 of Law No. 1.565 limits decisions with significant effects taken solely by automated means. When doubt arises, request documents and escalate to compliance.

Cross-border files and incidents

Counterparties, registries and banks sit in many jurisdictions. Transfers out of Monaco follow articles 96 to 101. EU member states are deemed adequate. For other destinations, the APDP says the 2009 CCIN list still applies until a new ministerial list is adopted. EU parties sending data to Monaco follow their own rules; Monaco did not appear on the Commission’s adequacy list when consulted. Map where each service in the deal stores data before the first document moves.

A misdirected email or an exposed link can be a personal data breach. Under article 32, the controller notifies the APDP without undue delay and, where possible, within 72 hours, unless the breach is unlikely to create a risk to people’s rights and freedoms. Every breach is documented. The APDP has said that waiting for technical analysis does not justify delay, and details may follow in stages. The AMSN, Monaco’s national digital security agency, publishes security alerts and advisories.

Limits of this note

This piece covers information handling, not anti-money laundering advice. Law No. 1.362 and the AMSF’s full practical guide define each firm’s duties; this note draws on the guidance presentation. Aviation and yachting deals often engage foreign rules too. Confirm obligations with your compliance officer and counsel.