KYC Requirements for Account Opening in Tanzania: What the AML Regulations 2022 Require (2026)

Short answer: KYC for account opening in Tanzania is set by the Anti-Money Laundering Act, Cap. 423 (s.16), and the Anti-Money Laundering Regulations, 2022 (GN 397), as amended by GN 10A and GN 853E of 2023. The national identity card is the primary ID document, verification runs at three levels, accounts with expired IDs must be suspended, and since October 2026 the Act treats domestic and foreign PEPs differently.

This guide is for compliance, operations and branch teams at banks, microfinance institutions and SACCOS in Tanzania who design or run account opening. This is a practical guide, not legal advice; confirm requirements with your supervisor (the Bank of Tanzania, TCDC for SACCOS, or the FIU) or adviser. Checked against primary sources on 9 October 2026.

Creodata makes BAOS, account opening software for banks in Tanzania, so near the end we say plainly where it fits.

Which laws set KYC requirements in Tanzania?

• The Anti-Money Laundering Act, Cap. 423 R.E. 2023 (AMLA). Customer due diligence (CDD) is s.16; definitions are in s.3. The Revised Edition numbering came into force on 1 July 2025, so older regulations citing "section 15A" mean today's s.16.
• The Anti-Money Laundering Regulations, 2022 (GN 397), Part III, as amended by GN 10A and GN 853E of 2023. The FIU listed no later amendment on 9 October 2026.

The rules bind every "reporting person": banks, financial institutions and microfinance service providers, except Tier 4 community groups (AMLA s.3). We found no separate Bank of Tanzania KYC regulation. Treat the FIU's 2009 guidelines as background, and don't cite the 2012 Regulations that BoT's page still lists: GN 397 revoked them.

The AMLA applies to Mainland Tanzania; Zanzibar's AMLPOC Regulations, 2022 also accept the Zanzibar resident identity card as a primary document. See our guide to the Anti-Money Laundering Act, Cap. 423.

Step 1: set the customer's risk level

Regulation 7(2) sets three levels of CDD:

Where a customer's risk "has not been determined, enhanced customer due diligence measures shall be applied" (reg 7(3)). So the risk level comes first.

What information must a bank collect from an individual?

Reg 2 defines three sets:

• Basic personal information: full name; gender; nationality; date and place of birth; residential address; the identification document "indicating the type of document and number"; a means of communication; and a "signature or biometric information".
• Detailed adds occupation and the business or employer's address.
• Enhanced adds the purpose of the relationship, the source of funds or wealth, and the reasons for transactions.

An address, not an address document. Where there is no physical address, the neighbourhood, locality or village, town or city, district or region and country will do. The Regulations name no proof-of-address document. Some banks accept a letter from the ward or village executive officer; that is bank practice, not a legal requirement.

No TIN in the individual list. Basic personal information does not include a taxpayer identification number (TIN); for entities, the Regulations ask for one "where applicable".

Is the national ID card required to open a bank account in Tanzania?

Yes, as the primary document. Reg 8(1)(a): "the primary identification document shall be the national identity card". Other documents are accepted only in exceptional circumstances (reg 8(1)(b)):

1. the customer is not a citizen or resident and cannot get the card;
2. the law does not let the customer hold one, for example because of age;
3. the card is lost and the customer presents a police loss report;
4. the customer is low risk.

The other listed documents are a passport or travel document, driving licence, voter's registration card, employee ID and student ID (reg 2). Simplified CDD does not mean skipping ID: it still needs basic information and basic verification.

What do basic, detailed and enhanced verification mean?

So the national ID is the primary document, and checking it with NIDA is part of enhanced verification. We found no text requiring every bank to query NIDA for every customer; your policy can go further. Our NIDA verification guide covers access, fees and address letters.

What happens when a customer's ID expires?

Reg 8(1)(d): "the account of the customer whose identification document or entity registration document has expired shall be suspended until the relevant document is renewed, or until another acceptable document is made available". While suspended, only deposits, withdrawals by the bank for pre-existing loans or pre-defined charges, withdrawals under a lawful order, and closure are allowed.

The rule covers entity documents too, so record every document's expiry date. Since February 2023 (GN 96 of 2023), only cards issued to legal residents, refugees and stateless persons show an expiry date. We found no primary text that settles the status of older citizen cards printed with one, so agree your treatment of them with your supervisor and record the decision on the file.

When must verification be complete?

The texts differ:

• AMLA s.16(1)(d): do "not commence a business relationship prior to completion of customer due diligence, provided that, under proven low risk, business relationship may commence pending the verification process".
• GN 10A, reg 8(1)(i): verification may finish after opening if it happens as soon as reasonably practicable, is essential not to interrupt normal business, and the risks are managed.
• GN 853E, reg 8(3): activities allowed pending verification include "opening and allowing an initial deposit or deposit of funds for any new or existing low risk services".

The regulation does not limit late verification to low risk; the Act does. Follow the Act, and record when verification completed.

Remote customers. Reg 9(j) treats a customer not physically present, "without proper safeguards", as an increased risk. No text names a required method, so your policy should name your safeguards.

When CDD cannot be completed, don't open the account, end any existing relationship, and file a suspicious transaction report: the Act says "submit" (s.16(1)(e)-(f)), GN 10A "consider making". Follow the Act. See suspicious transaction reports in Tanzania and FIU goAML registration.

Simplified and enhanced due diligence

Simplified measures are allowed "if the risk assessments have identified low risk areas and there is no suspicion" (AMLA s.15(14)), and stop when data is doubted, risk rises or there is suspicion (reg 11). We found no statutory monetary threshold for a low-value account.

Enhanced due diligence applies to high-risk cases, persons in high-risk jurisdictions, cross-border correspondent relationships, false or stolen documents, and complex or unusual transactions (reg 10(1)). Tanzania itself left the FATF's increased-monitoring list on 13 June 2025.

Who counts as a PEP after Act No. 6 of 2026?

The Written Laws (Miscellaneous Amendments) Act No. 6 of 2026, published on 2 October 2026, replaced the single PEP definition with two. A domestic politically exposed person (AMLA s.3, as amended in 2026) is an individual "entrusted domestically with prominent public functions": heads of state or government, senior politicians, senior government, judicial or military officials, senior executives of state-owned corporations and important political party officials, with their family members or close associates. A foreign PEP holds such functions for a foreign country, or is in senior management of an international organisation.

Two points to watch. The old "prominent public function" definition, pointing to public leaders under the Public Leadership Code of Ethics Act (Cap. 398), was left in place: use the Cap. 398 list as a screening aid, not as the definition. And the Act gives no commencement date; confirm it with your supervisor. If your forms ask whether the customer is a "public leader", update the wording. See PEP screening at account opening.

How long must KYC records be kept?

At least ten years from when the transaction was completed, the relationship formally ended, or an analysis or risk assessment was completed (AMLA s.17(1)(b)). That covers "know your customer files" (s.17(1)(a)). Where a report or investigation exists, keep them as long as the competent authority requires (s.17(2)).

Groups, SACCOS and joint accounts

Community groups (Tier 4) under the Microfinance Act 2018, often called VICOBA, are registered by local government authorities under powers delegated by BoT, on a Form No. 3 certificate (GN 678 of 2019, reg 11(3)). We found no rule on what a bank must collect, so your CDD applies to the group and each signatory. Banks commonly ask for the constitution, minutes naming signatories, a member list and signatories' IDs; some ask for a local-government letter. See chama and group accounts.

SACCOS (Tier 3) are licensed by TCDC under delegated powers (GN 675 of 2019) and are reporting persons, so the AMLA and GN 397 apply to member onboarding. We found no SACCOS-specific member-KYC rule. See SACCO member onboarding.

Joint accounts: we found no joint-account rule in the AML texts, so set the approach in policy; see joint account opening requirements.

A KYC checklist for opening an account in Tanzania

For companies, see corporate account opening requirements in Tanzania.

Where BAOS fits

Whatever system you use, check that it records which ID was used and why, holds expiry dates, shows who verified what and when, and uses the 2026 PEP terms.

BAOS is the account-opening workflow that sits beside your identity-verification provider and your core banking system. Two Tanzania templates ship. "Tanzania personal account" offers the NIDA national ID, passport, voter's ID and driving licence as ID types, with TZS income bands, proof of residence, and an optional TIN certificate and introducer letter. "Tanzania enterprise" covers the TIN with a format check, VAT number, business licence, region, district and ward address, and the BRELA certificate and other company documents. They are starting points: some wording predates the 2026 changes, so your team reviews them before publishing. Forms can carry English and Swahili; the staff interface is English.

BAOS records the PEP declaration made in the application and beneficial owners with their shareholding, and lists every person who needs screening once each. Reviewers claim an application, verify documents and approve or reject it, then record the account number once the core banking system opens the account. Every workflow action is recorded with who, what role, when and from which address.

BAOS does not check IDs with NIDA, BRELA or TRA, run liveness or face match, screen against lists, rate risk, or book or suspend accounts. Screening runs in your screening tool, such as Creodata's AML software for Tanzania; see the AML software buyer's guide for Tanzania to compare tools.

BAOS runs from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata. Azure has no region in East Africa (the nearest are South Africa North and South Africa West). BoT's 2023 cloud guidelines bar hosting mission-critical systems, as BoT determines them, outside Tanzania, and data transfers abroad need a PDPC permit. Where your rules keep data or systems in Tanzania, choose the on-premises deployment. The Enterprise AI features run on Azure AI services outside Tanzania.

See BAOS in Tanzania for how the templates map to these rules, or the BAOS product page for plans.

Frequently asked questions

What are the KYC requirements to open a bank account in Tanzania?

Set the risk level, collect the matching information, take the national ID card as the primary document, verify, identify beneficial owners and agents, check PEP status, and keep the file ten years (AMLA ss.16 to 17; GN 397).

Can a customer open an account without a national ID card?

Only in the listed exceptions: a non-citizen or non-resident who cannot get one, a person the law bars from holding one, a lost card with a police loss report, or a low-risk customer (reg 8(1)(b)).

What happens if a customer's ID expires?

The account is suspended until the document is renewed or replaced; only deposits, withdrawals for existing loans or charges, withdrawals under a lawful order, and closure are allowed (reg 8(1)(d)).

Is a "public leader" still the test for a PEP in Tanzania?

Not since October 2026. Act No. 6 of 2026 introduced domestic and foreign PEPs; foreign PEPs always get enhanced measures, domestic PEPs only in higher-risk relationships (AMLA s.16(2)).