AML Compliance Software in Uganda: A Buyer's Guide for Banks, SACCOs and Fintechs (2026)
How to choose AML compliance software in Uganda: FIA and goAML requirements, the types of provider, evaluation criteria, what drives cost, and red flags.
Short answer: Good anti-money laundering (AML) compliance software for a Ugandan accountable person does five jobs well: it screens customers against sanctions and PEP data, rates customer risk, monitors transactions across every channel you run, including cash and mobile money, turns alerts into documented cases on the clocks the Financial Intelligence Authority (FIA) sets, and gets suspicious and large cash transaction reports to the FIA through goAML. Choose on evidence from scripted demos on your own data, and compare three-year costs on the same basis.
This guide is for compliance officers, MLROs, heads of risk and procurement teams at Ugandan banks, microfinance deposit-taking institutions (MDIs), SACCOs, mobile-money and payment firms, insurers, forex bureaus and other accountable persons who are replacing spreadsheets or an older system. Uganda has twice been on the FATF grey list, most recently until 23 February 2024, and was on neither FATF list after the June 2026 plenary. Scrutiny did not end with the exit: in August 2024 the FIA put clocks on alert handling, and fines for failing to comply with a directive can now reach officers and directors personally.
Creodata offers AML compliance software in Uganda, so we say plainly where we fit near the end. The criteria before that are the ones we would use to choose any vendor. This is a practical guide, not legal advice: confirm requirements against current law and guidance from the FIA and your supervisor.
What AML compliance software does
AML software turns your customer and transaction data into the decisions an AML programme has to make, and keeps the evidence of each one.
| Function | What it does | What matters in Uganda |
|---|---|---|
| Customer due diligence and risk rating | Scores each customer's money-laundering risk from factors such as geography, product, channel and PEP status | A model your compliance team can change, with every override approved and recorded |
| Sanctions and PEP screening | Checks names against sanctions lists, PEP data and adverse media, at onboarding and whenever lists change | Matching that copes with Ugandan names and spellings, and proof of which list version was used |
| Transaction monitoring | Runs rules and models over transactions to raise alerts on suspicious patterns | Cash, mobile money and agent coverage, and one customer's same-day cash added up across branches |
| Case management | Turns alerts into owned cases with deadlines, evidence and approvals | Working-day timers for the FIA's alert, investigation and STR clocks; MLRO approval |
| Regulatory reporting | Prepares suspicious and large cash transaction reports | goAML files the FIA's portal accepts |
| Audit trail | Records every action and decision | An append-only log that stands up when the FIA or your supervisor examines it |
The complete AML platform guide explains each function in depth.
Who needs AML software in Uganda
The Anti-Money Laundering Act, 2013 places its duties on accountable persons, listed in its Second Schedule. Virtual asset service providers were added to the list in 2020, and Statutory Instrument 2025 No. 17, made on 5 February 2025, removed NGOs, churches and other charitable organisations.
Each accountable person's supervisory body enforces compliance, and the FIA does so where there is none (section 21A of the Anti-Money Laundering Act, 2013, as amended). Uganda's second National Risk Assessment (2023), published by the FIA, allocates the main sectors like this:
| Sector | Supervisor |
|---|---|
| Banks, MDIs and credit institutions | Bank of Uganda, for prudential and AML/CFT purposes |
| Tier 4 microfinance institutions, including SACCOs, and money lenders | Uganda Microfinance Regulatory Authority (UMRA); some SACCOs are licensed by the Bank of Uganda instead |
| Insurers | Insurance Regulatory Authority of Uganda |
| Capital markets firms | Capital Markets Authority |
| Casinos and gaming | National Lotteries and Gaming Regulatory Board |
| Accountants | Institute of Certified Public Accountants of Uganda (ICPAU) |
| Virtual asset service providers, real estate agents and other sectors with no supervisor | The FIA |
For payments and mobile money, the Bank of Uganda licenses payment service providers under the National Payment Systems Act, 2020.
Not every institution needs the same system. A large bank needs real-time monitoring across many channels, while an MDI or SACCO usually needs dependable screening, risk rating and reporting first, at a cost that fits its size. Spreadsheets carry a very small institution only until volumes grow or an examiner asks why a customer was rated low risk and the answer is in someone's memory.
The Ugandan requirements that shape the choice
Most vendor demos look alike until you test them against the rules you actually work under. Section numbers below are those of the Anti-Money Laundering Act, 2013, as amended. The Act is now cited as Cap. 118 in the 7th Revised Edition of the Principal Laws of Uganda, in force since 1 July 2024, which renumbered sections: the FIA's STR Guidance Note, effective 1 December 2024, cites the STR duty as section 10(1) of Cap. 118.
- Reporting through goAML. The FIA receives reports through goAML at its production portal, goaml.fia.go.ug, so the software must produce files the portal accepts. Our Uganda FIA goAML reporting guide covers registration and filing.
- STRs within two working days. Suspicious transactions, including attempted ones and regardless of value, must be reported without delay and not later than two working days from the date the suspicion was formed (section 9(1) and (2)). The clock runs from suspicion, so each case needs a recorded date of suspicion, not just an alert date.
- The FIA's alert clocks. Guidelines the FIA issued on 12 August 2024, with immediate effect, and restated in the Guidance Note expect alerts to be opened within 3 working days of being generated, investigations completed within 10 working days of the alert, terrorist-financing and proliferation-financing suspicions reported without delay, and supplementary STRs filed within 2 working days of discovering new facts. Each should run as a working-day timer.
- Large cash above UGX 20 million. Every cash or monetary transaction, in domestic or foreign currency, exceeding 1,000 currency points (UGX 20 million, at UGX 20,000 a point) must be recorded on Form A (section 8), and transactions by or for one person in one day are added together. The same line applies to every accountable person. The Act says "exceeding"; regulation 39(3) of the Anti-Money Laundering Regulations, 2015 says "equivalent to or exceeding", so check the rule can be set either way.
- No set filing deadline for large cash. The Act leaves the period for filing Form A copies to be prescribed by the Minister (section 8(5)), and we found none in the 2015 Regulations as amended or on the FIA's large cash web page. Confirm the FIA's current expectation, and make the deadline a setting, not code.
- Ten-year records. Records must be kept for at least 10 years from the latest of identification, the transaction, or account closure or the end of the relationship (section 7(3); regulation 42(1) of the 2015 Regulations, raised from five to ten years in 2023). Case files and report history need to stay retrievable as long.
- Fines that reach individuals. Under the Anti-Money Laundering (Amendment) Act, 2022, the FIA or a supervisory body can fine an accountable person that fails to comply with a directive up to 37,500 currency points (UGX 750 million), whether or not it is charged, and can fine its officers, directors and agents too.
If your group also operates in Kenya, see our buyer's guide to AML compliance software in Kenya; the rules there differ.
The types of AML software provider in Uganda
A search for AML software or AML solutions in Uganda returns very different kinds of supplier. Knowing which kind you are talking to tells you what to test.
| Provider type | Typical strengths | Watch for |
|---|---|---|
| Global AML suites | Depth, large-bank references, mature analytics | Cost, long implementations, and whether FIA goAML reporting and mobile-money monitoring work out of the box or through partners |
| AML modules from core banking vendors | Tight integration with the vendor's own core system | Screening and monitoring depth compared with specialist tools, and lock-in to one core platform |
| Local software houses and consultancies | Local presence, advisory expertise, help with policies and reporting | Whose software it is, who supports it, and whether it is a full system or a tracker for obligations and policies |
| Identity verification and KYC API providers | Fast digital onboarding and document checks, often with a coverage page for each country | A Uganda coverage page lists onboarding checks, not transaction monitoring, case management or FIA reporting |
| Regional AML software vendors | goAML reporting and East African payment channels built in | Support arrangements in Uganda, references of similar size, security assurance, and the roadmap behind each module |
| Spreadsheets and in-house builds | Low starting cost, full control | Key-person risk, no audit trail, and the cost of keeping pace with FIA changes |
The types can be combined, for example an identity verification API at onboarding and an AML system for everything after it, provided they share one record of the customer.
Evaluation criteria
Score every vendor against the same requirements, weighted before the first demo.
| Area | What to test |
|---|---|
| Regulatory fit | A goAML file the FIA's portal accepts; working-day timers for the FIA's alert, investigation and STR clocks; a UGX 20 million cash rule with same-day aggregation per person; a large cash filing deadline you can set |
| Risk rating | Compliance can change the model without code; overrides need four eyes; ratings explain themselves |
| Screening | Matching quality on your own sample of Ugandan names; list coverage and cost; false-positive control |
| Transaction monitoring | Cash, mobile money, agent and bank-transfer coverage; cash split to stay under UGX 20 million; back-testing before rules go live |
| Case management | The date suspicion was formed on every case; MLRO approval; tipping-off controls; an append-only audit trail |
| Data and integration | Proven integration with your core banking, SACCO or mobile-money platform; visible handling of failed feeds |
| Deployment and data | Where data is stored and processed; the same features in cloud and on-premises editions; security assurance |
| AI governance | Explanations for every score; a human makes the decision; model approval and rollback |
| Commercials | Three-year cost; currency of the quote; implementation plan; references; exit terms; regulatory updates included |
How to run the evaluation
- Set priorities with compliance, risk, IT and procurement before meeting vendors.
- Long-list suppliers and drop those that fail your Must-have requirements.
- Issue an RFP with your questions and the evidence you expect. Our free AML vendor RFP checklist and scoring template was written for Kenya, but most requirements carry over once you swap in the FIA, the Anti-Money Laundering Act and your supervisor.
- Run scripted demos on your own data: a domestic PEP at onboarding, a sanctions near-match on a Ugandan name, cash deposits by one customer at two branches on the same day that together pass UGX 20 million, and an alert taken to an STR with every FIA clock visible.
- Call references of similar size and sector, and ask what went wrong.
- Score independently, then calibrate as a panel, and file the scoring sheet with the decision papers.
What AML software costs in Uganda
Vendors price AML software in very different ways, so ask every shortlisted vendor to itemise the same lines over three years:
- Licence: per module or tier, per customer or account, per transaction, or a flat enterprise fee.
- List data: sanctions, PEP and adverse-media data is often a separate subscription.
- Implementation: data mapping, core-system integration, rule configuration and training, plus travel if the vendor's team is based outside Uganda.
- Hosting: cloud subscription and consumption, or servers and operations on-premises.
- Support, including whether changes to the FIA's goAML reporting are covered.
- Currency: US dollars or Uganda shillings, and who carries the exchange-rate risk.
- Internal effort: your analysts' and IT team's time during and after implementation.
A lower licence fee can hide higher data, integration or change-request costs, so compare three-year totals, not first-year quotes.
Red flags
- The vendor cannot show a goAML file the FIA's portal accepts, or treats FIA reporting as a future feature.
- STR deadlines run from the alert or transaction date, with nowhere to record when suspicion was formed.
- The large cash rule tests single transactions only, without same-day aggregation for one person.
- Screening is demonstrated only on the vendor's sample names, never on yours.
- An administrator can edit or delete audit entries.
- Answers about where your data is stored are vague or change between meetings.
- Must-have requirements are answered with roadmap dates.
Where Creodata fits
Creodata is a Nairobi software company, and our AML compliance software is a regional vendor's answer to the criteria above. It covers sanctions, PEP and adverse-media screening with multi-script matching and a false-positive workflow; customer risk rating across country, industry, product, channel, behaviour and PEP or sanctions exposure, with four-eyes overrides; batch and streaming transaction monitoring with back-testing; case management with enhanced due diligence; and an append-only audit log. Reports move through a draft, review, approve and submit lifecycle, and our separate goAML reporting software for Uganda generates and validates the file for the FIA's portal, with a manual download if the portal is down.
The cloud edition runs on Microsoft Azure as an Azure Managed Application. Azure has no region in Uganda, so if data must stay in the country or in your own data centre, choose the on-premises edition, which has the same features. Modules are licensed separately in Starter, Growth and Enterprise tiers, so an MDI or SACCO can start with screening, risk rating and case basics and a bank can run the full suite. Country differences are configuration, not code: see AML compliance software in Uganda for how each Ugandan duty maps to a module and the AML product overview for every module, or book a demo and bring your own scenarios.
Frequently asked questions
What is the best AML software in Uganda?
There is no single best system, only the best fit for your institution's size, channels and risks. Shortlist two or three vendors that meet your Must-have requirements, run the same scripted demos on your own data, and score them against one weighted checklist.
How much does AML software cost in Uganda?
It varies because vendors price differently: by module or tier, by customer or account, by transaction volume, or as an enterprise licence, with list data, implementation and hosting often extra. Ask each shortlisted vendor to itemise licence, data, implementation, hosting and support costs over three years in the same currency, and compare the totals.
Does AML software file reports with the FIA?
Reports reach the FIA through its goAML portal, so what matters is whether the software produces goAML files the portal accepts and tracks each report to acknowledgement. Ask for a validated sample file, and ask how the vendor handles changes to the FIA's reporting requirements. In Creodata's case, the AML software manages the report lifecycle and the separate Creodata goAML Reporting Platform generates and validates the file.
Do SACCOs and MDIs in Uganda need AML software?
Usually, once volumes grow. The core duties do not shrink with size: the UGX 20 million cash line, the two-working-day STR deadline and 10-year record keeping apply to every accountable person. MDIs answer to the Bank of Uganda, and SACCOs to UMRA or, for some, the Bank of Uganda. A small SACCO can work manually for a while, but proving it met the FIA's alert and investigation clocks is hard without a system that timestamps each step.
Should AML software be hosted in the cloud or on-premises in Uganda?
Either can work: cloud is faster to start and easier to scale, while on-premises keeps data in your own data centre. Microsoft has no Azure region in Uganda, so an Azure-hosted system stores data outside the country. Decide with your legal and risk teams whether that is acceptable, check what your supervisor expects of outsourcing, and ask each vendor where data is stored and processed and whether both options have the same features.
How long does it take to implement AML software?
It depends mostly on data and integration, not the software. Screening and risk rating need clean customer data; transaction monitoring also needs reliable feeds from every channel, including mobile money and agents. A phased plan that starts with screening and risk rating and adds monitoring once feeds are proven reduces risk. Ask vendors for a plan with named responsibilities on both sides.
See how Creodata's AML compliance software in Uganda meets these criteria: book a demo and bring your own scenarios.
