CamFinTech
Regulatory and compliance advisers to institutions connecting to the Kingdom of Cambodia's national digital infrastructure.
Phnom Penh · Established 2024 · Fee-only
- Bakong · KHQR
- National Bank of Cambodia
- CamDX · CamDigiKey
- Techo Startup Center
- CamInvoice
- General Department of Taxation
- Digital assets · Prakas 093
- SERC
Statement of practice
The Royal Government built the rails. Bakong settles at national scale, CamDX carries data between ministries and licensed institutions, and CamInvoice is bringing invoicing into a single system. The standard for connecting to any of them is set by the National Bank of Cambodia, the NBFSA and SERC, the Techo Startup Center and the General Department of Taxation.
Meeting that standard is mostly not an engineering exercise. The requirements are prudential — AML and CFT programme design, governance, capital planning, documentation — assessed by more than one authority and often alongside a sponsoring member bank. Most financial technology firms are engineering organisations and hold no risk or compliance function, so the work falls to people trained for something else.
This practice supplies that function, and hands it over. Our people have worked inside the regulators, and we would rather leave the competence inside a client's team than remain necessary to it. Compliance capability held in Cambodia is worth more to this market than compliance capability flown in.
Practice
The firm works across the approvals, the compliance programmes and the client-side integrations that connect a regulated institution or a rail-using enterprise to Cambodia's digital public infrastructure.
Connection to the national rails
SRV-01
CamDX and CamDigiKey enablement
Approval to connect to the national data-exchange and digital-identity systems, and the client-side integration that follows.
SRV-02
Bakong and KHQR integration
Payment Service Institution licensing or member-bank sponsorship, and connectivity to the national payment rails.
SRV-03
CamInvoice readiness
Gap assessment and a costed plan against the General Department of Taxation's requirements, ahead of the phased business-to-business mandate.
SRV-04
CamInvoice service-provider enablement
Connection of a client's ERP to the e-invoicing rail, delivered with an accredited Service Provider where platform depth is the better fit.
Licensing and market entry
SRV-05
Licensing readiness
Identification of the applicable National Bank, NBFSA or SERC licence, gap mapping against its requirements, and preparation of the application.
SRV-06
Market entry
For foreign institutions establishing in Cambodia — entity formation, licensing strategy, and the sequence of approvals that reaches the rails.
Risk, compliance and security
SRV-07
AML and CFT programme design
Customer due diligence and enhanced due diligence, transaction monitoring, CAFIU reporting and MLRO support — built to be demonstrated in supervision, not filed.
SRV-08
Security review
Cyber-risk advisory and pre-launch review against the National Bank's Technology and Cyber Risk Management Guidelines. Penetration testing is routed to an accredited security firm.
SRV-09
Data-protection governance
Consent, retention, processor governance and data-protection-officer support, ahead of the Kingdom's Personal Data Protection Law.
SRV-11
Digital-asset service provider readiness
Readiness for the SERC regime under Prakas 093, in force since 30 December 2025 — AML and CFT build, governance roster, and sandbox-to-full application preparation. Full specification
Capability transfer
SRV-10
Professional training and handover
Cohort training in digital public infrastructure, cybersecurity and regulatory compliance, so that a client's own team operates the integration and the programme after handover.
How an engagement proceeds
- 01Readiness diagnosticWhich rails, which licences, and where a submission would fall short today.
- 02Application preparationThe submission is assembled and supported to the published standard. The client is the applicant of record throughout.
- 03Compliance programmeAML and CFT, governance, and the controls expected before go-live.
- 04Integration and handoverThe client-side integration is built by the firm, or delivered by an accredited Service Provider under its management. Either way the firm runs acceptance testing and handover.
- 05Continuing supportRetainer or MLRO support, so the programme holds after the approval.
Where an accredited Service Provider is the better fit for a build — BanhJi, Innolab and Odoo, MAQSU, SAP and Crimson, KOSIGN, Metfone, GK-Smart — the firm engages them as a disclosed sub-contract and remains accountable for the programme. Their work is never marked up, and the firm does not compete for their clients. Pricing is indicative until validated by quote.
How the firm is constituted
Set out in full, including its boundaries. Several things a client needs belong to a licensed professional, to the operator, or to the regulator, and the firm would rather name them than blur them.
Standing commitments
- Fee-only
- Professional fees for advisory and delivery. No commissions, no share of transaction value, no markup on a partner's invoice.
- No client funds
- Funds move through the licensed operator. They do not move through this firm.
- No rail operation
- The client, or its sponsoring member bank, is and remains the licensed operator.
- Reserved work to licensed professionals
- Bar-admitted counsel, licensed tax agents, accredited security firms. Coordinated openly, never marked up.
- Paid for process competence
- The fee reflects the work of preparing a submission to standard — never influence over how it is decided.
Where the boundaries fall
- The approval decision
- The regulator's, entirely. The client is the applicant of record; the firm prepares the work rather than presses the case.
- Custody and operation of the rail
- The licensed operator's — the client, or its sponsoring member bank.
- Transaction traffic
- The client's. The firm builds the integration; the client runs it, on the client's infrastructure.
- Legal opinions and tax filings
- Bar-admitted counsel's and licensed agents'. The firm runs the surrounding programme.
- Any share of transaction value
- Outside the fee basis, so that advice does not depend on what a client processes.
Where both are delivered, it is disclosed
The firm may build a client's integration and prepare its approval on the same engagement, and a reader is entitled to ask about that. The client is always the applicant of record: the licence, the filing and the operator role are the client's. The firm does not influence a regulator's decision and does not claim to; its work is meeting the published bar. Where both scopes are delivered, that is disclosed in the engagement letter and priced separately, so either can be taken elsewhere without penalty.
Published reference
The firm maintains a public reference on Cambodian financial-technology regulation and the national rails. It is open, it is dated, and it is the most direct way to assess how the practice works before speaking to anyone.
Regulatory instruments
17 instrumentsLaws, sub-decrees and Prakas governing Cambodian financial technology. Each entry records the source that was read and the date it was read, and states what the instrument does not cover.
Knowledge base
8 papersExtended technical and regulatory references on the rails and the approvals that reach them.
Explainers
12 articlesShorter reference pieces on how each rail works and what it requires.
Insights
6 analysesAnalysis of the Cambodian market and its digital-infrastructure programme.
Engagement scenarios
4 scenariosIllustrative scoping documents showing how an engagement is structured and where the boundaries fall. Not client engagements.
Glossary
10 entriesDefinitions of the institutions, rails and instruments referred to throughout.
The firm also publishes The Riel Report, an independent record of Cambodian financial-technology developments.
Why this work, and why now
“…significant progress in its Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) framework, with strengthened laws and better inter-agency coordination. However, it also highlights a critical gap between legislative development and operational implementation across various sectors. Key deficiencies include inconsistent beneficial ownership verification, limited data integration, and uneven quality in suspicious transaction reporting.”
That is the Royal Government's own assessment of where the work lies, and it describes this practice's subject exactly: the distance between a framework that exists and a programme that operates.
NRA II also sets capacity building among its recommended actions — specialised training and a wider understanding of AML and CFT obligations across sectors. That is the part of this practice we care most about, and the reason every engagement is written to end in a handover.
Contact
Office
30 Preah Norodom BoulevardSangkat Phsar Thmey 3
Khan Daun Penh
Phnom Penh 12210
Kingdom of Cambodia
Specific enquiries
- dasp@camfintech.com — Prakas 093
- partners@camfintech.com — partners and sub-contract