AML for Microfinance Banks in Kenya: Which CBK Rules Apply, Agents and Penalties (2026)

Short answer: Deposit-taking microfinance banks (MFBs) are reporting institutions under the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA), and the Central Bank of Kenya (CBK) supervises them for anti-money laundering (AML). They follow POCAMLA, its 2023 Regulations, CBK's 2025 guidance and three MFB-specific sources: the Microfinance Act, the 2008 deposit-taking microfinance regulations and CBK's agent guideline. CBK's AML guideline for banks, CBK/PG/08, does not apply to them, and CBK can impose AML penalties of up to KES 5 million on an MFB, against KES 20 million on a bank.

This guide is for MLROs, compliance heads and boards at Kenya's 14 MFBs. It covers what differs from banks and links to our AML guide for banks for shared duties. It is a summary as at October 2026, not legal advice; the Acts, regulations and CBK's own texts are authoritative.

---

Are microfinance banks reporting institutions, and who supervises them?

Yes. POCAMLA defines a "financial institution" by activity, and both accepting deposits and lending count. An MFB does both.

CBK is the AML supervisor. Section 4A(1)(h) of the CBK Act lists the institutions CBK supervises for AML, and item (iv) is "microfinance banks and their agents". Section 36B(1) of the Microfinance Act, in force since 15 September 2023, adds that CBK "shall regulate, supervise and enforce compliance" for AML by the reporting institutions it supervises. The Financial Reporting Centre (FRC) can also supervise every reporting institution, and its 2024 annual report shows all 14 MFBs registered at the end of 2024.

SACCOs are a different sector, supervised by SASRA (see our SACCO guide).

Which CBK rules apply to MFBs, and which do not

Much of CBK's AML material is scoped to banks only.

No MFB-specific CBK AML guideline was found. An MFB's programme rests directly on the 2023 Regulations: a management-level money laundering reporting officer (MLRO), with the FRC and CBK told of any appointment or removal within 14 days (reg 12); a documented risk assessment, updated at least every two years (reg 7; see our risk assessment guide); and an independent audit function (reg 43).

The drafts would not change this. CBK's draft revised PG/08 and draft Risk Management Guidelines, published for comment on 10 September 2026 (comments close on 7 November 2026), keep the Banking Act scope.

Circulars arrive as "Banking Circulars". No. 2 of 2019 (an independent external AML review, with a one-off deadline of 31 May 2019) and No. 14 of 2023 (due diligence and record keeping) were both addressed to MFBs.

Reporting is the same as for banks: suspicious transaction reports (STRs) within two days after the suspicion arose, and cash transactions of USD 15,000 or more by the Friday of that week. The banks guide, CTR threshold guide and goAML guide cover the mechanics.

Microfinance Act powers and penalties

Section 36B(2) gives CBK nine AML powers over MFBs, from vetting proposed shareholders, directors and senior officers to onsite inspection and the power to "impose monetary, civil or administrative sanctions". Section 33D of the Banking Act gives CBK the same powers over banks.

The difference is the ceiling. Section 36C(1) applies to any "institution, director, officer, employer, agent or any other person", so agents and individual officers are exposed too.

POCAMLA's criminal offences, such as wilfully failing to file an STR, apply on top.

KYC rules in the DTMI Regulations (reg 37)

Regulation 37 of the Microfinance (Deposit-Taking Microfinance Institutions) Regulations, 2008 gives MFBs their own know-your-customer (KYC) rule. Each MFB must:

• obtain and maintain "proper identification of customers", including those dealing "indirectly through proxy";
• keep records on customers, sources of funds and transactions "for a minimum of seven years";
• establish that it is dealing with "a person that actually exists", and identify who may transact for others;
• document the nature of the business and expected activity levels;
• have "full disclosure of beneficial owners or controlling persons behind nominee accounts and engagement".

Reg 37(5) states: "No institution shall carry out business with any anonymous persons in obvious fictitious names and any numbered accounts." Breach is an offence. Banks may run numbered accounts with full due diligence (POCAML Regulations reg 36); MFBs may not. Regulation 38 adds internal controls, including "reliable information systems", reviewed at least yearly.

CBK's 2025 guidance notes on customer due diligence (CDD), politically exposed persons (PEPs) and beneficial ownership, effective 1 September 2025, name MFBs in their scope. The CDD note accepts manual or automated systems for spotting unusual activity. Under the 2023 Regulations, foreign PEPs always get enhanced measures and domestic PEPs get them where the risk is higher (see our PEP guide).

Summarising Kenya's 2022 mutual evaluation, CBK's CDD guidance says banks and MFBs in particular carry out CDD and record keeping on an ongoing basis, but that weaknesses remain in verifying source of funds or wealth, beneficial ownership and domestic PEPs. Test those first.

Agents: CBK approval, two-factor authentication and 24-hour reporting

Regulation 12(1) states: "No institution shall open or operate an agency or outlet without the prior written approval by the Central Bank." Breach is an offence, and agents themselves fall under CBK's AML supervision.

CBK's agent guideline for deposit-taking microfinance institutions, CBK/DTM/MFG/1 (effective 2 January 2012), sets the AML rules:

• An agent-network application must include AML policies and procedures.
• Agents may collect account-opening documents, but may not open accounts, grant loans or appraise an account opening.
• The MFB must monitor agent business for AML and train its agents.
• Agents must identify customers with at least two-factor authentication and report all suspicious activity to the MFB within 24 hours.

CBK still lists the guideline, and no amendment was found. Banking Circular No. 14 of 2023 adds that contracts shifting KYC liability to a third party are not supported in law, and that institutions using agents must verify the agents' beneficial owners.

The channel is small: CBK's 2025 annual report shows four MFBs with 432 agents at the end of 2025, against 93,341 at 15 commercial banks. The agent's 24-hour report is internal; the MFB's own two-day STR deadline still applies, so the hand-off to the MLRO should be quick and recorded.

What CBK's sanctions survey found for MFBs

CBK's survey on targeted financial sanctions for the year ended 31 December 2024 (its Preventive Measures Survey, published in 2025) drew answers from all 38 commercial banks, a mortgage finance institution and all 14 MFBs, as well as forex bureaus, remitters, payment providers and digital lenders. The answers are self-reported, and each figure is a share of the MFBs that answered that question, not of all 14.

No CBK guidance note on sanctions was found; the rules are in the 2026 sanctions regulations, with the FRC's July 2025 guidance alongside, covered in our sanctions and PEP screening guide. Risk assessment (reg 7) and an independent audit function (reg 43) are legal duties for every reporting institution, so those low figures mark gaps to check.

Outsourcing and hosting

No CBK outsourcing-approval rule in force for MFBs was found. CBK/PG/16, which makes banks seek approval for material outsourcing, covers Banking Act institutions only.

CBK's draft Guidance Note on Third-Party Technology Service Providers, published for comment on 10 September 2026 (comments close on 7 November 2026), would cover Microfinance Act institutions. It would expect a cloud risk assessment covering data location and cross-border transfers. It is not in force.

The Data Protection Act applies now: personal data may leave Kenya only with proof of appropriate safeguards or where the transfer is necessary. Microsoft Azure has no region in Kenya; its African regions are in South Africa.

Compliance checklist

1. Confirm your FRC registration on goAML is current.
2. Base your AML policy on POCAMLA, the 2023 Regulations, Microfinance Act ss.36B and 36C, DTMI regs 12, 37 and 38, CBK/DTM/MFG/1 and CBK's 2025 guidance, not on PG/08.
3. Appoint a management-level MLRO who is not the CEO or internal auditor; notify the FRC and CBK of changes within 14 days.
4. Document a risk assessment that covers the agent channel, and update it at least every two years.
5. Apply reg 37 in full, with no anonymous or numbered accounts.
6. Get CBK's written approval before opening any agency, and verify each agent's beneficial owners.
7. Check that agents use two-factor authentication, never open accounts, and report suspicious activity within 24 hours.
8. Screen against the UN lists and Kenya's Domestic List; freeze and report within 24 hours of a designation.
9. File STRs within two days and CTRs by the Friday, keep records for at least seven years, and send the annual compliance report to the FRC by 31 January.
10. Keep an independent audit function, and record where AML data is hosted.

Where Creodata fits

Creodata's AML compliance software is licensed by module. The Starter tier covers sanctions, PEP and adverse-media screening, a six-factor customer risk rating with four-eyes (dual-approval) overrides, and case management basics; the Growth tier adds transaction monitoring, STR and CTR reporting, and ingestion connectors. Delivery channel is one of the six rating factors, each weighted and banded to match your risk assessment. Every decision is kept in an append-only audit log, reports hand off to the Creodata goAML Reporting Platform for the FRC filing, and it runs on Microsoft Azure or on-premises in your own data centre with the same features.

Frequently asked questions

Does CBK/PG/08 apply to microfinance banks in Kenya?

No. PG/08 covers institutions licensed under the Banking Act, and MFBs are licensed under the Microfinance Act; the August 2026 draft keeps that scope.

Who supervises microfinance banks for AML in Kenya?

CBK, under section 4A(1)(h) of the CBK Act and section 36B of the Microfinance Act. The FRC can also supervise and penalise any reporting institution.

What are the AML penalties for a microfinance bank in Kenya?

CBK can impose up to KES 5 million on the MFB, KES 1 million on an individual and KES 100,000 a day while a breach continues (Microfinance Act s.36C). The FRC can separately impose up to KES 25 million on a company.

What are CBK's KYC requirements for microfinance banks?

Regulation 37 of the 2008 DTMI Regulations requires proper identification, proof the customer exists, beneficial owners behind nominee accounts, seven-year records and no anonymous or numbered accounts. The 2023 Regulations, CBK's 2025 guidance and Banking Circular No. 14 of 2023 add detail.

Can microfinance bank agents open accounts?

No. Under CBK/DTM/MFG/1, agents may collect account-opening documents but may not open accounts or grant loans. They must also report suspicious activity to the MFB within 24 hours.

Do microfinance banks have to use automated AML screening?

No rule in force requires it; CBK's CDD guidance accepts manual or automated systems. In CBK's sanctions survey for 2024, 75% of the MFBs that answered said they already use automated screening tools.

---

See how Creodata's AML compliance software supports screening, risk rating and FRC reporting at a microfinance bank: book a demo.