Kenya's National Risk Assessment and Your Customer Risk Rating (2026)

Short answer: Kenya's first money laundering and terrorism financing (ML/TF) national risk assessment (NRA) was launched on 27 July 2022. A 2023 round updated the ML findings and assessed terrorism financing, virtual assets and legal persons, and the TF assessment was updated again in 2024. There is no separate "2025 NRA": the Financial Reporting Centre's (FRC's) February 2025 ML and TF guidance summarises the 2023 to 2024 work. Under regulation 20(2) of the POCAML Regulations, 2023, higher national risks must be met with enhanced measures or built into your risk assessments, and FRC Circular No. 7 of 2023 directs institutions to update their risk assessments and customer risk profiles.

This guide is for MLROs and compliance teams at Kenyan reporting institutions, as at 19 October 2026. The Act, the Regulations, the NRA documents and the regulators' own texts are authoritative; this is not legal advice.

---

Kenya's national risk assessments at a glance

Government documents date the first NRA's work differently (2019 to 2021, 2020 to 2021, or October 2021), so this guide calls it the 2021 NRA.

No standalone proliferation financing (PF) risk assessment was found.

Is there a 2025 national risk assessment?

No 2025 or 2026 NRA report was found. The February 2025 documents, listed by the FRC as "ML Risk Assessment Guidance, Feb. 2025" and "TF Risk Assessment Guidance, Feb. 2025", are summaries. Seven 2023 assessments used different approaches, the FATF's reviewers found the results were not harmonised, and Kenya's FATF action plan called for consistent guidance. Cite "the FRC's February 2025 NRA guidance", not "the 2025 NRA".

What the assessments found

National ratings: the documents disagree

We found no official document reconciling Kenya's headline ML ratings. Cite the document and date with any rating, and ask the FRC which is current.

On terrorism financing, the December 2023 TF report rated overall TF risk Medium. The February 2025 TF guidance rates inherent TF risk High and residual TF risk Medium High. The FRC's 2024 annual report mentions a 2024 TF update, which may explain the change; no public copy was found.

Predicate offences and countries

The 2023 ML update found fraud still leads by number of cases, but corruption and economic crimes lead by value. The February 2025 ML guidance puts 2021 to 2023 proceeds at about USD 299 million for corruption and economic crimes, USD 104 million for fraud and forgery and USD 87 million for tax crimes, and rates those three offences High.

The 2023 update rates cross-border ML threat High for the UAE, Mauritius, Tanzania, Uganda, Somalia, South Sudan and Nigeria. The 2025 guidance's list adds the DRC, the USA and Poland.

Sector ratings

• Banking is the sector most likely to be abused for ML (2025 guidance), with vulnerability High for large commercial banks and Medium for microfinance banks.
• Conflicts. FRC Circular No. 7 of 2023 bands securities, casinos and precious-metals dealers differently from the 2021 report. For virtual-asset TF risk, the September 2023 report says Low and the 2025 guidance Medium Low.
• Betting. The 2021 NRA rated ML risk Low for individual bettors but High for betting-firm owners.

Sector detail: our guides for banks, microfinance banks, insurers, betting and gaming and SACCOs.

What the law requires of your own risk assessment

Regulation 7: the institutional risk assessment

POCAMLA has no section requiring institutions to assess their own risk; the duty is in regulation 7 of the Proceeds of Crime and Anti-Money Laundering Regulations, 2023 (Legal Notice 153 of 2023). Every reporting institution must assess its ML, TF and PF risks, document the assessment and keep it up to date. It must "consider all the relevant risk factors including customers, countries or geographical areas, products, services, transactions or delivery channels" before setting the overall risk level and mitigation (reg 7(2)(b)).

The results drive Board-approved policies, controls and procedures (reg 7(3)). Risk assessment policies or programmes must be updated "at least once every two years", taking account of changes such as new markets, products and services (reg 7(5)). Regulation 8 adds a documented risk assessment before you launch new products, practices or technologies.

For banks, CBK's 2018 guidance note lists national risk assessments as a risk factor, adds an update after any significant event, and requires an annual report to CBK by 31 December.

Regulation 20(2) and FRC Circular No. 7 of 2023

Regulation 7 does not mention the NRA. The link is regulation 20(2):

"Where higher risks are identified, either at national, sectoral or institutional level, a reporting institution shall address such risks through— (a) applying enhanced measures to manage and mitigate the identified risks; or (b) ensure that this information is incorporated into its risk assessments."

That gives two routes; national ratings are not adopted automatically. Regulation 21 allows simplified due diligence where lower risks have been identified through an adequate analysis, but never "whenever there is suspicion of money laundering, terrorism financing or proliferation financing, or specific higher risk scenarios apply."

FRC Circular No. 7 of 2023, "Risk Based Approach to Mitigate Money Laundering and Terrorism Financing Risks Posed by Different Sectors" (7 November 2023), directs reporting institutions to:

1. take note of the 2021 NRA, the 2023 TF, virtual-asset, legal-persons and non-profit assessments, and sectoral assessments;
2. update their institutional risk assessments, policies, controls and procedures, and their customer risk profiles;
3. apply enhanced measures where risk is higher, and simplified measures only where it is lower and there is no suspicion.

The FRC still listed the circular in mid-2026.

What supervisors add

• CBK. Its PEP guidance (effective 1 September 2025) tells licensees to take NRA findings, including on legal persons, real estate, lawyers and the high proceeds-generating offences, into account in regulation 7 assessments and to apply them to PEPs. Its CDD guidance points to the 2021 NRA and later updates.
• SASRA. Its guideline (SASRA/GG/1/2024, para 5.1) says SACCOs must understand their risks taking national and sectoral findings into account.
• CMA. Circular CMA/MRT/No.06/2023 builds its risk-based approach guidance on the 2021 NRA's securities findings.
• Draft, not in force. CBK's draft revised CBK/PG/08 (August 2026, comments due 7 November 2026) would make NRA updates an express trigger for updating a bank's risk assessment.

Insurers should check IRA's June 2025 note on institutional risk assessment, which appears in search listings; we could not review it. The two 2025 FRC documents describe themselves as summaries for awareness and set no scoring method, weights or review frequency. Those choices are yours.

Turning NRA findings into a customer risk rating

CBK's CDD guidance rates customers low, medium or high, based on nature of business, geography, transaction behaviour, source of funds and ownership structure; its factor list adds PEPs, products, delivery channel and sanctions. A practical model uses six factors, each fed by the national findings:

See our guides on politically exposed persons in Kenya and sanctions and PEP screening; a confirmed sanctions match follows your sanctions procedure, not the rating.

Weighting and banding

No Kenyan text sets weights. CBK's 2018 note suggests a likelihood-versus-impact matrix with institution-set weights, and a three-tier or five-point residual risk scale. A workable approach:

• weight the factors to reflect your institutional risk assessment, and map the weighted total to bands such as low, medium and high;
• force a band in set cases, such as a foreign PEP;
• allow overrides only with a written reason and a second approver;
• record the NRA document and date behind each weight, so you can re-score when a new one appears.

Periodic review by band

Neither the Regulations nor CBK's CDD and PEP guidance sets a fixed review interval for each rating, so "annual review for high risk" is not a Kenyan rule. CBK says review frequency follows risk, with higher-risk customers such as PEPs reviewed more often. So set an interval for each band in your board-approved policy, with event triggers: a new national or sectoral assessment, a new product, a customer becoming a PEP, or a suspicious transaction report. Circular 7 asks for updated customer risk profiles, so re-score existing customers too, using transaction monitoring data for behaviour.

What the FATF still asks of Kenya

The FATF placed Kenya under increased monitoring in February 2024. As of the June 2026 plenary (statement of 19 June 2026), Kenya remains listed with seven items outstanding, including risk-based supervision, understanding of preventive measures and STR filing, and risk-based oversight of non-profits.

The February 2024 action plan's first item covered risk assessment: complete a TF assessment, present the NRA results consistently and update national strategies. It is not in the June 2026 list, although the FATF has not said expressly that it is closed. The FATF's August 2024 follow-up page rates Kenya Partially Compliant on Recommendation 1, assessing risk and applying a risk-based approach.

The next plenary is scheduled for 26 to 30 October 2026; check the FATF statement afterwards. Our POCAMLA and POTA guide covers the wider framework.

Compliance checklist

1. Collect the 2021 NRA, the 2023 reports, the February 2025 guidance and your supervisor's sectoral assessments.
2. Cite the document and date behind every rating; where documents conflict, record both and ask the FRC.
3. Map the findings to your customers, countries, products, services, transactions and delivery channels.
4. For each higher risk, record whether you apply enhanced measures or incorporate it into your risk assessment.
5. Update customer risk profiles, including existing customers.
6. Put factor weights, scoring and bands in a board-approved policy.
7. Set a review interval for each band, plus event triggers.
8. Limit simplified due diligence to documented lower-risk customers.
9. Assess new products and technologies before launch, and update risk assessment policies at least every two years.
10. Watch for the October 2026 FATF statement and new FRC publications.

Where Creodata fits

Creodata's AML compliance software for Kenya includes a customer risk rating built on six factors: country, industry or business type, product, delivery channel, customer behaviour, and PEP or sanctions exposure, each weighted and banded to match your risk assessment. Overrides need four-eyes (dual) approval. A PEP match from screening feeds the customer's risk rating and opens an enhanced due diligence review inside case management, with periodic reviews scheduled by risk band. Screening, risk rating, monitoring, cases and reporting share one record of the customer, and every decision is kept in an append-only audit log. It is licensed by module: the Starter tier covers screening, risk rating and case basics; the Growth tier adds transaction monitoring, STR and CTR reporting and ingestion connectors. It runs on Microsoft Azure or on-premises in your own data centre, with the same features.

Frequently asked questions

Is there a 2025 national risk assessment for Kenya?

No separate 2025 NRA report was found as at 19 October 2026. In February 2025 the FRC published ML and TF national risk assessment guidance summarising the 2023 to 2024 assessments.

Where can I find Kenya's national risk assessment report?

The 2021 NRA is on the CBK website (centralbank.go.ke) and the FRC website. The FRC posted the 2023 ML, TF and virtual-asset reports, and BRS hosts the legal-persons report.

What is Kenya's money laundering risk rating?

It depends on the document. The 2021 NRA rated national ML vulnerability Medium High (0.64) and the 2023 update's summary Medium (0.53); the FRC's February 2025 guidance rates national ML risk Medium High, so cite the document and date.

Do institutions have to use the NRA in their risk assessment?

Yes. Under regulation 20(2), higher risks identified at national level must be met with enhanced measures or built into your risk assessments. FRC Circular No. 7 of 2023 directs institutions to update their risk assessments and customer risk profiles.

How often should customer risk ratings be reviewed in Kenya?

Neither the Regulations nor CBK's CDD guidance sets a fixed interval. Review frequency follows risk, so set an interval for each band in your policy.

What is the risk-based approach in Kenyan AML law?

You assess your own ML, TF and PF risks (regulation 7), apply enhanced measures where risk is higher (regulation 20) and simplified measures only where it is lower and there is no suspicion (regulation 21). The NRA is an input to your assessment, not a substitute for it.

---

See how Creodata's AML compliance software scores customers on six weighted factors, banded to match your risk assessment, with four-eyes overrides and reviews scheduled by band, or book a demo.