Beneficial Ownership in Kenya: The BRS Register, BOF Forms, Deadlines and Penalties (2026)

Short answer: Kenyan companies, limited liability partnerships (LLPs) and, since 25 September 2026, trusts must keep a register of their beneficial owners and lodge it with the Business Registration Service (BRS). On the company and LLP registers the test is at least 10% of the shares, votes, capital or profits, board appointment rights, or significant influence or control; anti-money laundering (AML) due diligence sets no percentage. Companies lodge Form BOF1 and file changes within 14 days, or face penalties and strike-off. The register is not public; reporting institutions can request a limited extract on Form BOF6 for KES 600.

This guide is for compliance officers at Kenyan banks, SACCOs, insurers, fintechs and designated non-financial businesses and professions (DNFBPs), and for company secretaries, as at 19 October 2026. The Acts, regulations and regulators' texts are authoritative; this is not legal advice. Onboarding checks are covered in our guide to beneficial ownership at account opening.

---

Who is a beneficial owner in Kenya?

The Companies Act (s.3) defines a beneficial owner as "the natural person who ultimately owns or controls a legal person or arrangements", including those who exercise ultimate effective control. Two sets of rules turn that into a test, and they differ.

Companies limited by guarantee have their own five-limb test (reg 3(2A)), and joint holders each count (reg 3(2B)). Before 2023 the board limb was a right to appoint or remove "a director". We found no 25% threshold in any Kenyan primary source: if a group policy says 25%, change it, and write "at least 10%", not "more than 10%".

Who must keep and file beneficial ownership information?

Companies and LLPs keep BO records for 10 years after a person stops being a beneficial owner; trusts for seven.

Companies. An existing company had "sixty days of coming into force of this section" (s.93A(3)(b)), without a stated start date; BRS's Registrar of Companies Directive No. 01 of 2024 set 30 November 2024 for private companies. We found no exemption for listed companies or state corporations. The texts differ on one point: BRS's 2023 guide and its 2025 practice note PN/02 still give the 2019 rule of 30 days after preparing the register, which the Act dropped in 2023. Follow the Act and confirm with BRS.

Nominees. Nominees must disclose their status and their nominator (reg 4A), and the nominator, or a corporate nominator's beneficial owners, go on the BO register. Nominee directors also go on a separate, non-public register (s.138A).

Trusts. Written trusts register with the Registrar of Trusts, an office within BRS (s.77), and lodge their BO register with the application (s.22(2)(c)). No regulations under the Act had been found by 19 October 2026, so trust BO forms and fees are not yet prescribed.

No duty found. We found no BO filing duty for partnerships, business names, NGOs or public benefit organisations (PBOs), or co-operatives. They still need customer due diligence.

The BRS beneficial ownership forms: BOF1 to BOF8

The forms sit in the First Schedule to the Companies (Beneficial Ownership Information) Regulations (LN 12 of 2020, amended by LN 32 of 2022 and LN 162 of 2023). They were renumbered in 2023, so older BRS material calling the cessation notice "BOF3" is out of date. LLPs use the matching forms LBOF1 to LBOF8.

BOF1 is one form per beneficial owner, recording when the person became a BO, the nature of their ownership or control, who lodged it and the source of the information. The company verifies each owner's particulars, including ID number, KRA PIN and date of birth, before lodging (reg 3(3), (4A)).

Companies file on BRS Version 2 (brsv2.ecitizen.go.ke) under "Maintain Company" > "Update Beneficial Ownership Information", then sign, scan and upload the generated form. BRS calls this a free service, but the fee schedule still lists KES 500 for a BOF5, so check the charge on eCitizen. If a beneficial owner ignores the company's notices, the company restricts their interest and records the gap on Form BOF3 (regs 4 to 11).

Penalties and BRS enforcement

The KES 500,000 fine is not a general BO penalty: it attaches to an existing company's failure to lodge its register.

On 11 April 2025 BRS wrote that the 30 November 2024 deadline had lapsed and that the Registrar believed the companies on its list might not be operating, citing missing annual returns and BO filings. They had 30 days to respond and file, or face a Gazette notice to strike them off. BRS keeps posting files labelled "BO-Compliance", the latest dated 15 October 2026, without saying exactly what they list; search for your company on its compliance notice page. We have not confirmed any strike-off on this ground yet. The October 2023 risk assessment adds that BRS withholds documents such as an up-to-date official search (often called CR12) from non-compliant entities.

Who can see the beneficial ownership register?

Not the public. Regulation 15 says BO information "shall not be made available to the public or be published", except PPRA's data on tender winners and government publication in the public interest. Competent authorities, such as the FRC and KRA, get it on request (reg 14).

Financial institutions and DNFBPs file Form BOF6, stating the reason for the search, and pay KES 600. The Registrar replies on Form BOF7, which gives the company's basic details and, for each beneficial owner, only the name, postal address and nationality: no ID numbers, dates of birth or ownership percentages. It may be used only for customer due diligence.

This route opened with LN 162 of 2023 (19 October 2023), and a company may also give its BO information to a financial institution directly (reg 13(2)(d)). We found nothing on whether BRS answers BOF6 requests online or how fast, so do not plan on instant lookups. LLPs use Form LBOF6, also KES 600. The Registrar of Trusts may disclose to reporting institutions (s.78(8)(d)), but we found no form, fee or channel for it yet.

What Kenya's 2023 risk assessment of legal persons found

Kenya's first money laundering (ML) and terrorism financing (TF) risk assessment of legal persons and arrangements, dated October 2023, rated trusts and private limited companies riskiest: Medium for ML, Medium Low for TF. Foreign companies, public companies, LLPs and companies limited by guarantee were Medium Low for ML, and national vulnerability was Medium.

It found no BO register for trusts, no BO duty for LLPs during the assessment period, no access for reporting institutions and no PEP flag in the register, and noted that BRS had sent 89,000 notices to non-compliant companies. It recommended a review of trust law, which the 2026 Act followed, and legislated discrepancy reporting, which is only partly in place. See Kenya's national risk assessment and customer risk rating.

What FATF and ESAAMLG said

ESAAMLG's September 2022 mutual evaluation rated Kenya's effectiveness on legal persons and arrangements (Immediate Outcome 5) Low, and Recommendations 24 (legal persons) and 25 (legal arrangements) Partially Compliant. It found that only companies had a BO regime, that institutions could not use BRS data, and that the trust regulator lacked the mandate and capacity for AML supervision. Most of those gaps have since been addressed in law, and the August 2024 follow-up report re-rated R.24 to Largely Compliant; R.25 stays Partially Compliant. Follow-up reports do not re-assess effectiveness, so the Low rating for IO.5 dates from 2022.

Kenya has been under FATF increased monitoring since February 2024 and, as of the June 2026 plenary, remains there. Item 3 of its action plan asks Kenya to designate an authority to regulate trusts and collect accurate, up-to-date BO information, and to act on breaches of transparency rules. The Trust Administration Act came later; it creates a Registrar of Trusts but names no AML supervisor for trusts, and FATF has not yet said whether it meets item 3. The next plenary is 26 to 30 October 2026.

What AML reporting institutions must do about beneficial owners

Identify and verify, whatever the risk. POCAMLA s.45(4)(b) requires reasonable measures "to identify and verify the identity of the beneficial owner using the relevant information or data obtained from a reliable source." You must also understand the ownership and control structure (reg 14(2)(b)). FRC Circular No. 5 of 2023, which applies to all reporting institutions, says the beneficial owner must be identified regardless of the customer's risk level; only the verification steps vary.

Legal persons: the three-step test. Regulation 16(2) works in order: a controlling ownership interest, then control by other means, then the senior managing official. The data may come from a public register, the customer or other reliable sources (reg 22(4)).

Trusts. Trustees must disclose their status (reg 18(3)); verify the settlor, trustees, protector, beneficiaries and anyone else with ultimate effective control (reg 18(4)).

At onboarding. Verify before or during onboarding (reg 25(3)). CBK's 2025 Guidance on Beneficial Ownership gives its licensees a cascading test and asks them to match declared owners against the BRS official search and BO form; our account-opening guide covers those steps.

After onboarding.

• Repeat due diligence when earlier data is in doubt (reg 14(5)(e)), and keep BO data up to date, higher-risk customers first (reg 35(b)).
• CBK licensees re-verify whenever BO information changes (BO guidance para 4.5); the Regulations contain no express change-of-ownership trigger.
• Where the beneficial owner is a foreign or high-risk domestic PEP, the FRC expects senior management approval, source of wealth and funds, and enhanced monitoring. See our PEP guide and sanctions and PEP screening guide.
• Keep records for at least seven years (POCAMLA s.46(4); reg 42).

Discrepancies. Only the company or the beneficial owner must report a material discrepancy to the Registrar, on Form BOF8 (reg 17). We found no duty for banks or other reporting institutions to report discrepancies to BRS. CBK tells its licensees to file a suspicious activity report with the FRC instead (para 4.8), and any institution must report a suspicious discrepancy to the FRC within two days (s.44(2)) through goAML.

For the wider framework, see our POCAMLA and POTA guide and AML compliance for Kenyan banks.

Compliance checklist

1. Check every company you manage on BRS's compliance notice page, and lodge any missing BO register (BOF1).
2. Lodge changes within 14 days (30 if listed; one month for a foreign company), including nominees.
3. For trusts, plan to lodge the BO register within the 24-month window.
4. Remove any 25% threshold from due diligence policies.
5. Identify the beneficial owners of every legal-person customer, whatever the risk, recording which reg 16(2) step found each.
6. Treat a BOF7 as one source among several: it holds no IDs or percentages.
7. Set BO review frequency by risk, and re-verify when ownership changes.
8. Screen beneficial owners, not only the customer, for PEP and sanctions exposure.
9. Report suspicious discrepancies to the FRC within two days; we found no duty to report them to BRS.
10. Keep BO and due diligence records for at least seven years.

Where Creodata fits

Creodata's sanctions, PEP and adverse-media screening, part of our AML compliance software for Kenya, checks customers, counterparties and beneficial owners against sanctions lists, PEP data and adverse media. A PEP or sanctions exposure feeds the customer's six-factor risk rating, and enhanced due diligence reviews run in case management. Every decision is kept in an append-only audit log, and the software runs on Microsoft Azure or on-premises in your own data centre. It does not query the BRS register or file BO forms.

Frequently asked questions

What is the beneficial ownership threshold in Kenya?

At least 10% of the shares or votes for the company register, plus board-appointment and significant-control limbs (reg 3(2)); LLPs also use 10%. AML due diligence sets no percentage, and we found no 25% threshold in Kenyan law.

What is the BOF1 form in Kenya?

Form BOF1 is the register of beneficial owners that a company lodges with the Registrar of Companies, one form per beneficial owner. Companies generate it on BRS Version 2 through eCitizen, then sign, scan and upload it.

What is the deadline for filing beneficial ownership information in Kenya?

New companies file at incorporation; BRS set 30 November 2024 for existing private companies. Changes are due within 14 days (30 for listed companies, one month for foreign companies, 21 days for trusts). Existing trusts have until 24 months after 25 September 2026.

What is the penalty for not filing beneficial ownership in Kenya?

Late changes cost KES 2,000 plus KES 100 a day for the company and each officer in default. An existing company that never lodges its register faces a fine of up to KES 500,000 on conviction, plus up to KES 50,000 a day, and strike-off.

Is the beneficial ownership register in Kenya public?

No. Banks and DNFBPs can request a company's BO data on Form BOF6 for KES 600 and receive names, postal addresses and nationalities only.

Do banks have to report beneficial ownership discrepancies to BRS?

We found no such duty: regulation 17 puts the BOF8 duty on the company or the beneficial owner. CBK tells its licensees to file a suspicious activity report with the FRC instead.

---

See how Creodata's AML compliance software screens beneficial owners alongside your customers and feeds any PEP or sanctions exposure into one risk rating, or book a demo.