KYC Requirements for Account Opening in Uganda: AML Regulations and BoU's CDD Guidelines (2026)

Short answer: KYC for account opening in Uganda comes from section 6 of the Anti-Money Laundering Act, 2013 (as amended) and regulations 19 to 27 of the AML Regulations 2015, as amended. Bank of Uganda's 2022 CDD Guidelines add detail for banks, credit institutions, MDIs, forex bureaus and money remitters. Individuals produce a national ID card, alien's ID card or NIN, and records are kept for at least ten years.

This guide is for compliance, operations and digital teams at banks, microfinance deposit-taking institutions (MDIs) and SACCOs in Uganda. This is a practical guide, not legal advice; confirm requirements with your supervisor (Bank of Uganda or UMRA) or adviser. Checked against primary sources on 9 October 2026.

Section numbers for the Act are the 2013 Act's, as amended; the revised edition's own numbering is not public. Creodata makes BAOS, account opening software for banks in Uganda, and we say plainly where it fits near the end.

Which instruments set KYC requirements in Uganda?

The Financial Institutions Act adds a duty to "demand proof of and record the identity" of customers (Cap. 57 s.139(1)(a)). BoU's guideline, issued under s.6(27) of the Act, is a minimum standard that does not replace the law (para 1.7), and it does not name SACCOs or e-money issuers.

Two cautions. The 2010 BoU AML Regulations are still published but partly out of date. And the 2022 guideline has slips, such as 48 hours for suspicious transaction reports (the Act says two working days) and a "Data Protection and Privacy Act, 2020" (it is No. 9 of 2019). Cite the Act and the Regulations.

What must a bank collect from an individual?

Regulation 19(1), as amended in 2023, requires a citizen or lawful resident "to produce a national identification card or an alien's identification card, whichever is applicable", and to provide any of:

• a residential address, and phone, postal and email details;
• an introductory letter from the employer or a senior government official;
• "a tax identification number, where applicable";
• for a student, a school letter and a copy of the student ID;
• a summary of business activities;
• a sample signature and thumbprint.

The rest of reg 19 matters for form design:

• Fingerprints. Take them where a person cannot sign (reg 19(1a)). Reg 19(6) goes further: capture "fingerprints of all persons for purposes of identification and verification in a manner that ensures quality and accuracy".
• Identity in doubt. Ask NIRA to confirm a citizen's identity, or the immigration board to confirm immigration status (reg 19(3)). Our NIRA verification guide explains where that check fits.

Foreign nationals not resident in Uganda (reg 20) give passport details, visa status, nationality, address, TIN where applicable, signature and thumbprint, verified with the immigration board, the customer's home bank or another reliable source.

Tax ID. We found no provision in the Tax Procedures Code Act that requires a TIN to open a bank account; the Regulations ask for one "where applicable". The 2025 change to tax identification numbers is covered in our guide to corporate account opening requirements in Uganda.

Companies, partnerships, trusts and people acting for them

• Local entities (reg 21): proof of registration and its number, "a certified copy of written authorisation permitting the entity or body to open an account", the people who manage, control or own it, and financial statements and TIN where applicable. Verify by comparing the incorporation documents with the Registrar's and checking the place of business (reg 21(2)).
• Foreign entities (reg 22): including everyone holding 5% or more of the voting rights.
• Partnerships, trusts and beneficial owners (regs 23 to 25). BoU's guideline uses a 5% shareholding marker for beneficial owners (para 9.1).
• People acting for a customer provide proof of authority (reg 27), and reg 2 defines "customer" to include "a signatory to a transaction or account".

We found no rule specific to joint accounts, but each holder and signatory is a customer, so each gets full CDD; see joint account opening requirements.

When must verification be complete?

"Before or during the course of establishing a business relationship" (s.6(5); reg 18(3)). It may finish afterwards only if it "occurs as soon as reasonably practicable", the risks "are effectively managed", and the delay "is essential not to interrupt the normal conduct of business" (s.6(6)). BoU asks policies to fix the timeframe in that case (para 6.2(j)). Record when verification finished, not only when the account opened.

Can you open an account online in Uganda?

Yes. Section 6(11) requires "specific and adequate measures" where the customer "is not physically present for the purpose of identification". Section 6(25) requires policies for non-face-to-face relationships, and s.6A a risk assessment of new delivery channels before launch.

BoU (para 9.7) asks for the same standards as in person and suggests certified or additional documents, independent contact with the customer, and third-party introductions under conditions. It does not mention biometric, selfie or video checks, and no rule names a remote-verification method, so your policy chooses the methods and says why.

The 2010 BoU Regulations say local applicants should not open accounts by post, but the later 2017 Act allows non-face-to-face relationships with specific measures. Cite the Act.

Two more points. Reg 19(6) fingerprints cover "all persons", so agree with your supervisor how a remote journey meets it. And bank and MDI agents may collect and forward account-opening documents but may not open accounts (Agent Banking Regulations 2017, regs 14(1)(a) and 15(1)(m); MDI Agent Banking Regulations 2025).

Tiered KYC, SDD, EDD, PEPs and screening

BoU asks for tiered CDD, with basic requirements for small accounts and onboarding flexible enough for financial inclusion (para 6.2(c) to (d)), but sets no numeric tiers for bank accounts.

• SDD is allowed "where the risk identified by an accountable person is lower" (reg 15(5)), never on suspicion; BoU's examples include salary earners and children's accounts (para 5.4(b)).
• EDD (reg 15(3)) adds identity information, document checks, senior management approval, source of funds and monitoring.
• PEPs. Reg 29 requires written senior management approval and source of wealth and funds, "including for all domestic politically exposed persons", and covers family members and close associates. BoU wants account-opening documents to invite a PEP declaration (para 9.3.7(a)).
• Screening. Screen every new customer against the UN 1267 and 1373 lists before onboarding (BoU para 6.6). Under the FIA's directive of 5 September 2026, check within four hours whether a designated person is a customer, and freeze. Creodata's AML software for Uganda covers screening.

From 2027, the onboarding profile sets cash limits. From 1 January 2027 BoU caps over-the-counter cash withdrawals at UGX 50 million a day for individual accounts and UGX 500 million a day for business accounts, and risk-based customer profiles can set lower limits (circular of 29 May 2026). Record the account type and risk profile at opening.

What if CDD cannot be completed?

If CDD cannot be completed, the institution must not open the account, or must end the relationship, and must "make a suspicious transactions report" (s.6(15)). BoU's guideline says only "consider" a report (para 11.1); the Act prevails. Reports are due within two working days of forming the suspicion: see suspicious transaction reports in Uganda.

How long must KYC records be kept?

At least ten years from the latest of identification, the transaction or the end of the relationship (AMLA s.7(3); reg 42(1) as amended in 2023). Records may be electronic but not altered (reg 28), and BoU expects copies within 48 hours of a law-enforcement request (para 6.5). Our guide to the Anti-Money Laundering Act covers the wider duties.

SACCOs and self-help groups

SACCOs must be registered co-operative societies licensed by UMRA under the Tier 4 Act, and serve only members (s.36). A 2024 Bill to move UMRA's functions to the Ministry of Finance passed, but we found no assent, so write "UMRA (or its successor)". UMRA's AML Guidance Notes (October 2023) tell SACCOs to register with the FIA, apply KYC and CDD, report and keep records. FIA registration is by goAML only: see FIA goAML registration in Uganda.

Large SACCOs are the exception. Those with voluntary savings above UGX 1.5 billion and institutional capital above UGX 500 million must be licensed by BoU (SI 54/2023). BoU's notice of 28 September 2026 gives regulated institutions until 31 March 2027 to update their KYC and deal only with licensed large SACCOs, with no further extensions.

Self-help groups such as VSLAs, ROSCAs and SILCs register with the district Community Development Officer (Tier 4 Act s.99). Their certificate is valid for one to three years (UMRA guidelines, 2022). No rule says what a bank must collect for a group account; for clubs and societies the 2010 BoU Regulations list a constitution, signatories' identity and documents such as a certificate of registration. Banks commonly also ask for the resolution to open the account, the mandate and an introduction letter from the district officer. See chama and group account opening.

Where BAOS fits

Whatever system you choose, check that it carries Uganda's ID types, records which verification ran and its result, gives every director, owner and signatory their own record, and runs where your hosting rules allow. Our account opening software guide has a fuller checklist.

BAOS is the account-opening workflow that sits beside your identity-verification provider and your core banking system. Business, personal, group and joint accounts each have their own form. No Uganda template ships: your team builds the forms in the no-code form builder from the shared sections and adds Uganda's ID types, such as the NIN and the alien's ID card, to the option sets. Format checks ship for passport and phone numbers (and Kenyan and Tanzanian numbers), not for the NIN. Fields can carry English and Swahili, Uganda's official and second official languages (Constitution art.6); the staff interface is English.

Beneficial owners are recorded with their shareholding (BAOS does not calculate ownership), and BAOS lists every person who needs screening once each. Reviewers claim an application, verify documents, approve or reject it, then record the account number from the core banking system. Each workflow action is recorded with user, role, time and IP address.

BAOS does not check IDs with NIRA, search URSB or check URA records. It does not take fingerprints or run liveness, selfie or face-match checks. It does not screen against lists, rate risk or hold approval until screening is done, and it does not book accounts in core banking, send SMS or provide e-signature. Its audit record is not append-only.

Hosting. BAOS has two deployment options: from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata. Azure has no region in East Africa; the nearest are South Africa North and South Africa West. BoU's 2024 cyber and technology risk guidelines require supervised institutions to have in-country primary data centres and disaster recovery sites; where your data or systems must stay in Uganda, choose the on-premises deployment. The Enterprise AI features run on Azure AI services in East US 2 or Sweden Central, so that processing is not in Uganda.

See how BAOS maps to Uganda's rules, or the BAOS product page for plans.

Frequently asked questions

What are the KYC requirements for opening a bank account in Uganda?

A national ID card, alien's ID card or NIN, plus any of the reg 19(1)(b) particulars, such as an address and a TIN where applicable, with a signature and fingerprints. The bank verifies identity from reliable, independent sources (AMLA s.6(3)).

Does BoU's CDD guideline apply to SACCOs?

Not as written: para 1.5 covers banks, credit institutions, MDIs, forex bureaus and money remitters. SACCOs follow the Act, the Regulations and UMRA's guidance notes; the position of BoU-licensed large SACCOs is not settled.

Can a bank in Uganda open an account online?

Yes, with specific and adequate measures and a written policy (AMLA s.6(11), (25); BoU para 9.7). No rule names a method, and agents may not open accounts.

Is a TIN required to open a bank account in Uganda?

We found no such rule in the Tax Procedures Code Act. The AML Regulations ask for a TIN "where applicable", and for every partner in a partnership (reg 23(d)).

How long must KYC records be kept in Uganda?

At least ten years from the latest of identification, the transaction or the end of the relationship (AMLA s.7(3); reg 42(1)), and retrievable within 48 hours of a law-enforcement request (BoU para 6.5).