AML for Banks in Kenya: CBK/PG/08, the 2026 Draft and What CBK Expects (2026)

Short answer: The Central Bank of Kenya's (CBK's) AML guideline for banks is still CBK/PG/08, issued in January 2013. Parts of it are out of date, and where it differs from the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) and the POCAML Regulations, 2023, the law prevails: suspicious transaction reports (STRs) go to the Financial Reporting Centre (FRC) within two days after the suspicion arose, and cash transactions of USD 15,000 or more are reported by the Friday of that week. A revised PG/08 was published in draft for comment on 10 September 2026; comments close on 7 November 2026, and it is not in force.

This guide is for MLROs, compliance teams and boards at Kenya's commercial banks and its mortgage finance company, and reflects the texts as at 19 October 2026. The Act, the Regulations and CBK's and the FRC's own texts are authoritative; this is not legal advice. Microfinance banks have their own guide.

---

Who CBK supervises for AML

CBK licenses 38 commercial banks and one mortgage finance company, HFCB Limited (CBK directory, July 2026; 2025 Bank Supervision Annual Report). The FRC's 2024 annual report shows all 39 commercial and mortgage banks registered with it at the end of 2024.

Banking Act section 33D, added in 2023, makes CBK their AML supervisor, with powers that include onsite inspection, offsite surveillance, compelling documents and imposing sanctions. The FRC can also supervise every reporting institution (POCAMLA section 36A), so a bank answers to both. CBK/PG/08 applies to Banking Act institutions and their foreign branches and subsidiaries, not to microfinance banks. The CBK texts that apply to banks:

The duties that come from POCAMLA and the 2023 Regulations

Most of a bank's AML duties come from the Act and the Regulations, not from PG/08. Our POCAMLA and POTA guide covers the statute. In summary:

See also our guides to goAML reporting, the CTR threshold, national risk assessment and customer risk rating and politically exposed persons in Kenya.

CBK's 2025 CDD guidance records the gaps found in Kenya's 2022 mutual evaluation: verifying source of funds or wealth, beneficial ownership and domestic PEPs. Banking Circular No. 14 of 2023 told banks to verify identity from independent sources, treat beneficial ownership declarations only as a starting point, and have systems to verify source of funds and wealth.

CBK/PG/08 (2013): what it requires and where it is out of date

PG/08 still sets CBK's governance expectations. The board and management are responsible for AML policies and staff training (para 2.3). Every bank needs a documented AML programme with five elements: risk-based policies and controls, a designated compliance officer, independent testing, training, and staff screening at hiring (para 5.3.2). A new product's risk assessment goes to CBK before launch (para 5.5.4(b)).

Where PG/08 differs from the Act and the Regulations, follow the current rule:

On PEPs, PG/08 is stricter than regulation 26, so confirm CBK's expectation until the revision is final.

The August 2026 draft PG/08 and draft Risk Management Guidelines

A revised CBK/PG/08, dated August 2026, was published in draft for comment on 10 September 2026. It adds proliferation financing to the title, leaves the effective date blank and still covers Banking Act institutions only. Comments close on 7 November 2026; until CBK issues a final version, the 2013 text applies.

CBK has proposed:

• an MLRO at senior-management level reporting to the board or a board committee, and adequate financial, human and technological resources;
• an independent audit that also tests the reliability of reporting systems;
• the risk assessment submitted to CBK every year, though updated at least every two years;
• PEP rules split into foreign and domestic, in line with regulation 26;
• STRs within 48 hours of the suspicion, or 24 hours where linked to targeted financial sanctions, and CTRs at USD 15,000;
• screening records, including dormant ones, within 24 hours of a sanctions list update, and freezing within 24 hours of a confirmed match;
• new sections on wire transfers and on onboarding virtual asset service providers.

The same consultation includes draft Risk Management Guidelines 2026. Chapter 12 says a bank should have a monitoring system, suited to its size and risks, that covers all accounts and transactions, and should screen against sanctions lists with automated systems in or near real time. This is the firmest systems language CBK has published, but it is a draft. The rules in force do not require automated monitoring, and CBK's 2025 CDD guidance accepts manual or automated systems.

Wire transfers and correspondent banking (regulations 29 to 32)

These regulations go further than PG/08. Regulation 31 adds duties for banks offering money or value transfer services.

• Correspondent banking (reg 29). Before opening a relationship, a bank must understand the respondent's business, check its reputation, supervision and any ML or TF investigation or regulatory action, assess its AML controls, get senior-management approval and verify its ownership, including any PEP control. Payable-through accounts need assurance that the respondent has done CDD on customers with direct access.
• Shell banks (reg 30). No foreign account with a shell bank, no use of the bank's accounts by one, and no correspondent relationship with a shell bank or a respondent that lets shell banks use its accounts.
• Wire transfers (reg 32). Domestic and cross-border wires must "always have" required originator and beneficiary information, including names and account numbers or a unique reference; for domestic wires the originator details may instead be made available by other means. The rule applies to ordering, intermediary and beneficiary institutions, covers batch files and sets no minimum amount. Intermediary and beneficiary institutions need risk-based policies on when to execute, reject or suspend a wire missing information. Wires to or from persons designated under UN Security Council Resolutions 1267 and 1373 are prohibited.

PG/08 (2013) has none of the intermediary, batch-file or missing-information rules. The draft PG/08 would also bar ordering institutions from sending incomplete wires.

What CBK can do: powers and penalties

Section 33E covers breaches of POCAMLA and of any regulation, guideline or direction issued under it. The Banking (Penalties) Regulations, 2025 also reach Prudential Guideline breaches, but they are not AML-specific.

The one public case. CBK's only public announcement naming banks penalised for AML failures is its press release of 12 September 2018 on National Youth Service (NYS) transactions. It found failures to report large cash transactions, inadequate CDD, missing supporting documents and STR lapses, and assessed penalties on five banks under the Banking Act and the CBK Act, totalling KES 392.5 million; the largest was KES 149.5 million. No later CBK release naming a bank for AML failures was found, and the 2025 Bank Supervision Annual Report lists no AML violations among the year's breaches.

What the FRC's 2024 figures say about banks' reporting

The latest FRC annual report available covers 2024. That year banks and credit institutions filed 7,287 of the 8,057 suspicious transaction and activity reports the FRC received, about 90%, up from 6,131 of 6,628 in 2023. Banks also filed 94 of the 156 reports related to terrorism financing. The FRC received 7,802 cash transaction reports covering 234,787 transactions, but does not break CTRs down by sector.

Kenya has been under FATF increased monitoring since February 2024 and was still listed as of the June 2026 plenary; the FATF's outstanding items include understanding of preventive measures and STR filing. The draft PG/08 would put STR statistics in front of the board.

Outsourcing, cloud and hosting

CBK/PG/16 (2013) requires CBK approval for material outsourcing, and its examples include data processing, data centres and KYC for AML compliance. Offshore outsourcing is not allowed where it would impede CBK's or the auditors' access to information. The draft revision in the September 2026 consultation would name cloud IaaS, PaaS and SaaS as material arrangements. PG/16 applies to Banking Act institutions; no equivalent rule in force was found for microfinance banks.

Data Protection Act sections 48 and 49 also restrict transfers of personal data out of Kenya. Whether a cloud-hosted AML system is material outsourcing is for the bank to assess and, if it is, for CBK to approve. Microsoft Azure has no region in Kenya; its African regions are in South Africa. Creodata's AML software runs on Microsoft Azure or on-premises in your own data centre, with the same features.

Compliance checklist

1. Confirm your goAML registration, and that the MLRO is at management level and is neither the CEO nor the internal auditor. Tell the FRC and CBK of any MLRO change within 14 days.
2. Update the risk assessment for ML, TF and PF, get board approval of the policies, and diarise the two-year review.
3. Assess every new product or technology before launch, and send product assessments to CBK.
4. Replace any procedure still based on PG/08's STR timing or routing: STRs go to the FRC within two days after the suspicion arose.
5. File CTRs for cash of USD 15,000 or more by the Friday of that week.
6. Screen against the UN and Kenyan domestic lists, and be able to freeze and report within 24 hours.
7. Check wires for complete originator and beneficiary information, and refresh correspondent due diligence.
8. Keep records for at least seven years, and file the annual compliance report by 31 January.
9. Review cloud and third-party AML arrangements against PG/16.
10. Compare your programme with the drafts, and decide whether to comment before 7 November 2026.

Where Creodata fits

Creodata's AML compliance software for Kenya is licensed by module. The Starter tier covers sanctions, PEP and adverse-media screening, a six-factor customer risk rating with four-eyes (dual-approval) overrides, and case basics; the Growth tier adds transaction monitoring, STR and CTR reporting and ingestion connectors. A PEP match feeds the customer's risk rating and opens an enhanced due diligence review in case management. Screening, risk rating, monitoring, cases and reporting share one record of the customer, and every decision is kept in an append-only audit log. Reports hand off to the Creodata goAML Reporting Platform for the FRC filing; it generates schema-valid goAML XML from core-banking data, validates every report against the schema and business rules before submission, and keeps an immutable record of every report, amendment and filing. Both run on Microsoft Azure or on-premises in your own data centre, with the same features.

Frequently asked questions

What are the CBK AML guidelines for banks?

CBK's AML guideline for banks is CBK/PG/08, part of the Prudential Guidelines issued in January 2013 under Banking Act section 33(4). CBK has added guidance on CDD, PEPs and beneficial ownership (2025) and on risk assessment (2018). The binding deadlines and thresholds come from POCAMLA and the 2023 Regulations.

Is CBK/PG/08 still in force?

Yes. The January 2013 version still applies to banks and the mortgage finance company. A revised version was published in draft for comment on 10 September 2026, with no effective date set. Where the 2013 text conflicts with the Act or the Regulations, the law prevails.

What is the STR deadline for banks in Kenya?

Two days after the suspicion arose, under POCAMLA section 44(2) and regulation 38(1). The timing in PG/08 (2013) is out of date. The August 2026 draft would use 48 hours, and 24 hours for reports linked to targeted financial sanctions.

Does CBK require automated transaction monitoring?

Not under the rules in force. POCAMLA requires ongoing monitoring, and CBK's 2025 CDD guidance accepts manual or automated systems. CBK's draft Risk Management Guidelines 2026 expect a monitoring system and automated sanctions screening, but they are a draft.

What penalties can CBK impose on a bank for AML breaches?

Under Banking Act section 33E, up to KES 20 million for a bank, KES 1 million for an individual and KES 100,000 a day while the breach continues. The FRC can separately impose up to KES 25 million on a company under POCAMLA section 24B.

Does CBK/PG/08 apply to microfinance banks?

No. PG/08 applies to Banking Act institutions, and the draft keeps that scope. Microfinance banks follow POCAMLA, the 2023 Regulations and CBK's 2025 guidance notes; see our microfinance bank AML guide.

---

See how Creodata's AML compliance software keeps screening, risk rating, monitoring, cases and reporting on one record of the customer, or book a demo.