AML for Insurers in Kenya: The IRA Guidelines, 2025 Circulars and Penalties (2026)

Short answer: The Insurance Regulatory Authority's (IRA's) AML rulebook is the Insurance (Anti-Money Laundering and Combating Financing of Terrorism) Guidelines, Legal Notice 23 of 2020, in force since 6 March 2020. They cover insurers, takaful operators and microinsurers underwriting life business, plus brokers and agents; general (non-life) insurers are not named. Covered firms need an MLRO, a risk assessment, PEP checks, an information system that can detect suspicious activity, a UN sanctions database, an annual independent audit and quarterly reports to IRA, and must report suspicions to the Financial Reporting Centre (FRC) within two days. IRA can fine a company up to KES 20 million.

This guide is for MLROs, compliance teams and boards at Kenya's life insurers, reinsurers, takaful operators, microinsurers, brokers and agents, and reflects the texts as at 19 October 2026. The Insurance Act, the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA), the POCAML Regulations, 2023 and IRA's and the FRC's own texts are authoritative; this is not legal advice. Banks have their own guide.

---

Who IRA's AML rules cover (and who they do not)

Paragraph 2 of the Guidelines reads: "'regulated entity' refers to insurers, takaful operators and microinsurers underwriting life assurance, brokers and agents licensed under the Act." Under the Insurance Act, "insurer" includes a reinsurer.

The life-only focus comes from POCAMLA. Insurance is a reporting activity only for "underwriting and placement of life insurance and other investment related insurance", and a proviso adds: "Provided that this applies both to insurance underwriter and to insurance intermediaries including agents and brokers". The FRC's February 2025 risk guidance likewise names life underwriters, brokers and agents.

Three caveats:

• Paragraph 2 does not say in terms that "brokers and agents" means only life intermediaries, though the Act and IRA's 2025 circulars point to life business.
• POCAMLA separately lists "financial guarantees and commitments". No regulator text we found says whether a general insurer's bond or guarantee business is caught; take advice.
• The FRC's May 2025 STR guidance says life agents are outside the obligations. POCAMLA's proviso and IRA paragraph 2 both name agents, and the Act prevails: agents are not exempt.

IRA is entry (b) in POCAMLA's First Schedule of supervisory bodies, and the FRC can supervise every reporting institution (POCAMLA s.36A(1)), so a life insurer answers to both.

What the 2020 Guidelines require

Kenya Law's text runs to 31 December 2022 and is still flagged as the latest version.

Low-risk CDD may be completed up to 14 days after the relationship starts (para 21(4)); if identity cannot be established, end the relationship and file an STR (para 21(5)).

Remote onboarding. Paragraph 30 sets out extra checks for customers you do not meet, but paragraph 30(4) says: "A regulated entity shall only establish business relationships upon completion of the customer due diligence process that have been conducted through face-to-face interactions." Its reach is unclear, so confirm IRA's view before relying on fully remote onboarding.

The systems rule. Paragraph 37(1): "A regulated entity shall put in place an adequate management information system to complement its customer due diligence and which should provide the entity with timely information on a regular basis to enable the entity to detect any suspicious activity." It does not say the system must be automated, but IRA's 2025 review note says reviewers may test it. The monitoring triggers in paragraph 36(3) include a "change in beneficiaries to include non-family members", "use of cash for payment of large single premiums" and "early surrender of the policy". See our transaction monitoring guide.

IRA's 2025 circulars and the independent-review note

On 14 August 2025 IRA sent three AML circulars to life insurers and intermediaries.

The 31 March 2026 deadline has passed; firms that missed it should raise it with IRA. We could not obtain the risk assessment guidance note itself. Circular 14 also asks for enhanced measures where a legal-person beneficiary presents higher risk, including identifying its beneficial owner at payout. Our national risk assessment and customer risk rating guide explains how to use them.

IRA's Guidance Note on Independent Review of the AML Compliance Programme was issued on 30 June 2025. In summary:

• The review is not a financial audit. It tests whether the programme is adequate, appropriate, effective and compliant.
• Reviewers may be internal or external, but must be independent of the programme; the MLRO, risk-management officers and frontline underwriting, marketing and claims staff are not eligible.
• The scope may include the accuracy of management information systems, the timeliness and quality of STRs, and whether monitoring systems or software can identify unusual activity (paras 8.4.9 to 8.4.12).
• The principal officer prepares a remedial action plan for the board.
• Reviews happen at least yearly, and more often after a merger or new products or channels.

Risk context. The February 2025 national risk assessment guidance, which summarises Kenya's 2021 NRA and its 2023 update, rates the insurance and retirement benefits sector's ML risk Medium; its terrorism-financing counterpart rates insurance Low. FRC Annual Report 2024 figures show the insurance sector filing 32 STRs in 2023 and 38 in 2024, against more than 6,000 a year from banks. Kenya has been under FATF increased monitoring since February 2024 and was still listed as of the June 2026 plenary.

Where the 2020 Guidelines are out of date

The Guidelines pre-date the 2023 changes to POCAMLA and the 2023 Regulations. Where they conflict, the Act and the Regulations prevail.

On PEPs, paragraph 31 is stricter than regulation 26, so confirm IRA's expectation before relaxing it. Also check with IRA whether the Guidelines have been amended since 2022.

PEPs and life-policy payouts

The Guidelines require "a risk management framework to ascertain whether or not customers are politically exposed persons" (para 31(1)), source of funds, and enhanced continuing CDD that extends to family members and close associates. Life business adds a second person to check: the beneficiary.

1. When named. Paragraph 33 requires CDD on "beneficiaries of life insurance and other investment related insurance policies as soon as the beneficiaries are identified or designated". Under regulation 24(3), the beneficiary is "a relevant risk factor in determining whether enhanced customer due diligence measures are applicable".
2. At payout. Regulation 24(1) adds: "Provided that the verification of the identity of the beneficiary in paragraphs (a) and (b) shall occur at the time of the payout." Regulation 26(3) requires you to determine, by payout at the latest, whether the beneficiary or its beneficial owner is a PEP. In higher-risk cases, inform senior management before paying out, apply enhanced scrutiny and consider an STR.
3. In between. A change of beneficiary to a non-family member, and payments to non-beneficiaries, are monitoring triggers (para 36(3)).

In practice, screen beneficiaries when named and again before claims are paid. See our guides to politically exposed persons in Kenya and sanctions and PEP screening.

Reporting to the FRC: STRs, CTRs and goAML

Life insurers, brokers and agents must register with the FRC (POCAMLA s.47A; para 7(d)), which says registration is done only through goAML. Reports go through goAML too; our POCAMLA and POTA guide covers the statute.

• STRs. Report suspicious transactions and keep a register (para 39), including where a customer is "unreasonably evasive or uncooperative" (para 40(1)). The Schedule lists 36 indicators, such as a large policy cancelled soon after with a refund to a third party, or an unexpected jump in an agent's performance. The deadline is POCAMLA section 44(2): "within two days after the suspicion arose".
• CTRs. Cash transactions of US$15,000 or more, by the Friday of that week (reg 40).
• Sanctions. Freeze within 24 hours and report within 24 hours to the Counter Financing of Terrorism Inter-Ministerial Committee, through its Secretary, the FRC's Director-General.
• Annual report. A compliance report to the FRC by 31 January (reg 44), separate from IRA's quarterly report.
• Tipping-off. Disclosing that an STR is being prepared or has been sent is an offence (POCAMLA s.8).

See our guides to goAML reporting, filing a CTR, the CTR threshold and STR indicators.

IRA's powers and penalties

Section 196B of the Insurance Act, inserted by Act No. 10 of 2023, says IRA "shall regulate, supervise and enforce compliance" for AML, CFT and proliferation financing purposes. Its powers include vetting proposed owners, directors and senior officers, onsite and offsite supervision, and the power to "impose monetary, civil or administrative sanctions" and "issue guidelines, directions, rules or instructions". No 2025 AML amendment to the Insurance Act was found; Act No. 6 of 2025 changed other sector laws, not this one.

Compliance checklist

1. Confirm what is in scope: life and investment-related underwriting, broking and agency. Take advice on any guarantee or bond business.
2. Check your goAML registration and MLRO eligibility, and tell the FRC and IRA of any MLRO change within 14 days.
3. Update the risk assessment for ML, TF and PF, build in the national findings and review it at least every two years.
4. Map CDD and EDD to paragraphs 21 to 33, and agree your remote-onboarding position with IRA.
5. Screen beneficiaries and their beneficial owners for PEPs when named and again before payout; escalate higher-risk payouts.
6. Screen against the UN lists and Kenya's Domestic List; be able to freeze and report within 24 hours.
7. Make sure your information system catches the paragraph 36(3) triggers and the Schedule's red flags.
8. File STRs within two days of suspicion, and CTRs for cash of US$15,000 or more by the Friday of that week.
9. Commission the annual independent review and send it, with the board's comments, to IRA by 31 January.
10. File quarterly reports with IRA, the annual report with the FRC, and keep records for at least seven years after the relationship ends.

Where Creodata fits

Creodata's AML compliance software for Kenya is licensed by module. The Starter tier covers sanctions, PEP and adverse-media screening, a six-factor customer risk rating with four-eyes (dual-approval) overrides, and case basics; the Growth tier adds transaction monitoring, STR and CTR reporting and ingestion connectors. A PEP match feeds the customer's risk rating and opens an enhanced due diligence review in case management, with periodic reviews scheduled by risk band. Screening, risk rating, monitoring, cases and reporting share one record of the customer, and every decision is kept in an append-only audit log. Reports hand off to the Creodata goAML Reporting Platform for the FRC filing; it generates schema-valid goAML XML from core-banking data, validates every report against the schema and business rules before submission, and keeps an immutable record of every report, amendment and filing. Both run on Microsoft Azure or on-premises in your own data centre, with the same features.

Frequently asked questions

What are the IRA AML regulations?

IRA's AML instrument is a set of guidelines, Legal Notice 23 of 2020; no separate IRA AML regulations were found. The regulations that bind life insurers are the POCAML Regulations, 2023, and IRA added three AML circulars in August 2025.

Do the IRA AML guidelines apply to general insurers?

Not as written. Paragraph 2 covers insurers, takaful operators and microinsurers "underwriting life assurance", plus brokers and agents. POCAMLA treats insurance as a reporting activity only for life and investment-related business.

Are insurance agents covered by AML rules in Kenya?

Yes. POCAMLA covers "insurance intermediaries including agents and brokers", and IRA's Guidelines name both. An FRC guidance note from May 2025 says life agents are outside the obligations, but the Act prevails.

What is the STR deadline for insurers in Kenya?

Two days after the suspicion arose, under POCAMLA section 44(2); the IRA Guidelines set no deadline of their own. Cash transactions of US$15,000 or more are reported separately, by the Friday of that week.

Does IRA require automated transaction monitoring?

Paragraph 37 does not say the system must be automated. It requires an adequate management information system that can detect suspicious activity. IRA's 2025 review note says reviewers may test whether monitoring systems or software identify unusual activity.

What penalties can IRA impose for AML breaches?

Under Insurance Act section 196C, up to KES 20 million for a company, KES 1 million for an individual and KES 100,000 a day while the breach continues. IRA can also attach conditions to a licence or withdraw it, and the FRC has separate powers.

---

See how Creodata's AML compliance software keeps screening, risk rating, monitoring, cases and reporting on one record of the customer, or book a demo.