KYC Requirements for Opening a Bank Account in Zambia: The FIC Act and the 2022 Regulations

Short answer: Zambian banks must identify each customer and verify their identity "by means of reliable and independent source documents, data or information" when opening an account (FIC Act s.16(1)(a)). SI 54 of 2022 sets the detail: a photo ID or another listed source, a mobile number in place of an address where needed, and simplified checks for low-risk customers up to K10,000 a month. Records are kept for ten years.

This guide is for compliance, operations and product teams at Zambian banks, microfinance institutions and savings and credit co-operatives (SACCOs) who design account opening. This is a practical guide, not legal advice; confirm requirements with your supervisor (the Bank of Zambia or the Financial Intelligence Centre) or adviser. Checked against primary sources on 9 October 2026.

Creodata makes BAOS, account opening software for banks in Zambia. It records the application and the staff review, not the identity checks; we say where it fits near the end.

Which laws set KYC for opening a bank account in Zambia?

Customer due diligence (CDD) comes from two instruments:

• The Financial Intelligence Centre Act, 2010 (Act No. 46 of 2010), Part III. Sections 16 (identification and verification) and 19 (risk management) were replaced in 2020.
• The Financial Intelligence Centre (General) Regulations, 2022 (SI No. 54 of 2022), Part III (regs 7 to 11) and the Second Schedule of low-risk and high-risk factors.

The duties bind every "reporting entity", including banks and microfinance institutions as financial service providers under the Banking and Financial Services Act 2017 (the Microfinance Regulations 2006 add no identification rule). The Banking and Financial Services Act 2026 has been passed and is awaiting commencement. For the wider framework, see our guide to the FIC Act.

Does the Bank of Zambia set KYC requirements for bank accounts?

Not for CDD itself. The Bank of Zambia's AML Directives 2017 cover reporting, not due diligence, and we found no Bank of Zambia KYC, tiered-KYC or e-KYC instrument for bank accounts among the documents it lists. Its instruments touch account opening at the edges:

What must a bank collect from an individual?

Section 16(4)(a) sets the particulars: "for a natural person, the full name and physical address, and date and place of birth or a mobile number linked to a registered international mobile equipment identity number or sim card in place of a physical address". Your form needs that mobile-number path for customers without a formal address.

Section 16(11) defines an independent source document as "a passport, a driver's licence, a national identification document or a certified certificate of incorporation or other information that the Minister may prescribe." The FIC's 2019 banking guidelines name a validly issued NRC, passport or driver's licence that has not expired when CDD is done (§3.1(a)).

SI 54 reg 7(1)(a) sets how to verify. Compare the particulars with:

1. a driving licence, passport or national identification document bearing the person's photograph;
2. a reference from an employer, a professional, a customary authority, or an existing customer who has known the person for at least a year;
3. foreign-bank references, where possible, for a non-resident or non-citizen;
4. a Refugee Identification Card;
5. a credit reference agency search;
6. the latest council rates or utility bill receipt, original or certified; or
7. information from any other accurate independent source.

The list is joined by "or", so one means can be enough for a citizen. A citizen of another country also needs "a permit allowing a customer to reside in the Republic" (reg 7(1)(a)(viii)). How the NRC is issued, and what a register check adds, is in our guide to NRC and TPIN checks in Zambia.

When must verification be finished?

The default is before the account opens: s.16(2) requires verification "before it establishes an account or a business relationship". The Minister may prescribe exceptions (s.16(3)), and under simplified due diligence SI 54 reg 9(2)(a) allows an entity to "verify the identity of the customer and the beneficial owner after the establishment of the business relationship", finishing as soon as reasonably practicable (reg 9(6)). Record which path each account took and when verification finished.

Simplified due diligence and the K10,000 markers

FIC Act s.19(5) allows simplified measures where risks are lower. Part I of the SI 54 Second Schedule lists the low-risk markers, including:

• "a customer whose monthly income does not exceed ZMW10,000.00";
• "a customer whose monthly average withdrawals do not exceed ZMW10,000.00";
• listed companies and State enterprises;
• a limited financial-inclusion product, or a transaction of K10,000 or less.

You must "prove the low risk to the satisfaction of the Centre or the supervisory authority" (reg 9(3)), and simplified measures are barred where there is suspicion or a specific higher-risk scenario (reg 9(5)).

Tier 1 and Tier 2 KYC limits were set for e-money wallets (PSB Circular 01/2020, under directives since revoked), not bank accounts.

Higher risk: remote opening, prominent influential persons and EDD

The Second Schedule lists "non-face-to-face business relationships or transactions" as a high-risk factor (Part II para 3(c)). Section 18 requires due diligence "no less effective than where the customer appears in person", plus "additional documentary evidence or supplementary measures". No provision names a method, such as a selfie, liveness or video check, so your non-face-to-face policy must say what you use and why.

Other high-risk factors include non-resident customers and a "prominent influential person" (Zambia's term since 2020, in place of "politically exposed person"). For high-risk customers, s.19(4) requires senior-management approval, reasonable measures to verify the source of wealth and funds, and closer monitoring.

Signatories, people acting for the customer and joint accounts

For anyone acting for a customer, s.16(4)(d) requires "evidence that the person is properly authorised to act in that capacity". That person gets the individual checks (reg 7(2)), and you obtain "a power-of-attorney, a service level agreement or other proof of that individual's authority to act" (reg 7(5)). The FIC Act's "customer" includes "a signatory to a transaction or account", so every signatory has their own CDD file. See authorised signatories and signing mandates.

We found no joint-account rule in the FIC Act, SI 53, SI 54 or the banking Acts; each holder who signs is a customer (see joint account opening requirements). Companies, partnerships and trusts have their own lists, covered in our guide to corporate account opening requirements in Zambia.

Is a TPIN needed to open a bank account?

Yes. Income Tax Act s.45B lists "bank or financial institution" for "Account opening and holding", and the Bank of Zambia's CB Circular 05/2020 told commercial banks that a new account without a TPIN "should not be opened". Individuals are issued a TPIN from age 16. We found no exemption for non-residents or minors, and the texts do not say how the rule applies to children under 16, who cannot hold a TPIN; confirm your approach with the Bank of Zambia.

Co-operatives and SACCOs

Savings and credit co-operatives ("credit unions") are registered by the Registrar of Co-operatives under Part IX of the Co-operative Societies Act 1998. We found no Bank of Zambia licensing of SACCOs.

A co-operative society is an "accountable institution" under the FIC Act. The Fourth Schedule to SI 54 requires CDD "at the time of opening an account" (para 1.1), verification of name, address or SIM-linked mobile number, and date and place of birth against a photo ID or other accurate independent information (para 1.2), a TPIN review for bodies corporate (para 1.3), and records kept "for at least ten years from the date of transaction" (para 4). We found no named AML supervisor for co-operatives. For member journeys in BAOS, see SACCO member onboarding.

Can bank agents open accounts?

No. The Agent Banking Directives 2022 let an agent collect "account opening forms" (dir. 8(h)), but an agent shall not "open accounts, grant loans or carry out any customer due diligence for purposes of opening an account" (dir. 9(h)). The agent collects the form; your staff do the CDD.

Savings groups: chilimba and village banking

No law we found registers or regulates savings groups, and SI 54 reg 7 covers only natural persons, bodies corporate, partnerships and trusts. There is no rule that a group must register before it opens an account, but each signatory is a customer and goes through individual CDD.

For registered societies and co-operatives, bank checklists commonly ask for the certificate of registration, the constitution, signatories' IDs and the TPIN. We read no bank checklist for informal groups, so set a risk-based list in policy and agree it with your supervisor. See group account opening in BAOS.

When CDD cannot be completed, and how long to keep records

Anonymous and fictitious-name accounts are banned (s.15). If CDD cannot be completed, the entity "shall not open the account" and files a suspicious transaction report (s.16(9)); if CDD would tip the customer off, it files an STR instead (s.16(10)). Commercial banks must also notify the FIC when they de-risk clients (FIC directive of 27 December 2023). See our STR guide for Zambia and goAML reporting for Zambia.

Account files and identity documents are kept for "not less than ten years after the business relationship has ended", and transaction records for ten years from the transaction (FIC Act s.22(2)).

Where BAOS fits

Whatever system you use, check that it can take a mobile number in place of an address; record which reg 7(1)(a) means was used, by whom and when; mark simplified-due-diligence accounts and when verification finished; hold each signatory as a separate record; and run where Zambia's data protection law lets you store the data.

BAOS is the account-opening workflow that sits beside your identity-verification provider and your core banking system. Business, personal, group and joint applicants each have their own form; the business form is published by default and the others ship as drafts. No Zambia template ships: your team builds the forms in the no-code form builder from the shared sections and adds Zambian ID types, such as the NRC, to the option sets. BAOS checks passport and phone number formats; it has no NRC or TPIN format check. Forms can carry English and Swahili text; English is Zambia's official language (Constitution Art. 258(1)).

Staff verify documents against a checklist per person; BAOS lists every person who needs screening once each. Reviewers claim an application, approve or reject it, then record the account number once the core banking system opens the account. Every workflow action is recorded with who, what role, when and from which address.

Outside BAOS: NRC and passport checks (your verification provider), PACRA and ZRA lookups, list screening (your screening tool, such as Creodata's AML software for Zambia), risk rating, senior-management approval, and booking the account in core banking.

Hosting. The Data Protection Act 2021 says: "A data controller shall process and store personal data on a server or data centre located in the Republic" (s.70(1)). Sensitive personal data, which includes sex, marital status and biometric data, "shall be processed and stored in a server or data centre located in the Republic" (s.70(3)). Section 71 sets the conditions for transfers abroad, and s.71(4)(b) allows a transfer of sensitive data with explicit consent, which sits uneasily with s.70(3). The Bank of Zambia also requires prior approval for material outsourcing and for offshoring.

BAOS has two deployment options: from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata. Azure has no region in East Africa (the nearest are South Africa North and South Africa West), so where your data must stay in Zambia, choose the on-premises deployment. The Enterprise AI features run on Azure AI services, so that processing is not in Zambia. See how BAOS maps to Zambia's rules, or the BAOS product page for plans.

Frequently asked questions

What are the requirements for opening a bank account in Zambia?

By law: full name, physical address (or a mobile number on a registered SIM) and date and place of birth, verified against a photo ID such as an NRC, passport or driver's licence, or another listed source (SI 54 reg 7(1)(a)), plus a TPIN (Income Tax Act s.45B). A citizen of another country also needs a residence permit. Banks commonly ask for more.

Does the Bank of Zambia have KYC directives for bank accounts?

Not for CDD. The rules are in the FIC Act Part III and SI 54 of 2022; the Bank of Zambia's AML Directives 2017 cover reporting. Its circulars deal with student accounts, the TPIN, agents, e-money wallets and virtual-asset customers.

Are SACCOs supervised by the Bank of Zambia?

We found no primary source saying so. Credit unions are registered by the Registrar of Co-operatives, and co-operatives are "accountable institutions" under the FIC Act, with CDD and ten-year record duties.

Does BAOS check NRCs?

No. BAOS captures the ID details on your published form and records the staff review; NRC checks come from your identity-verification provider or your own process.