POCAMLA Kenya: Meaning, Duties and the 2023 Regulations

Kenya's AML/CFT compliance environment in 2026 bears little resemblance to the relatively permissive landscape of five years ago. The Financial Reporting Centre (FRC) now has administrative penalty powers that were widened in 2023 and again in 2025, and it has begun publishing the penalties it imposes. The Central Bank of Kenya (CBK) has integrated AML/CFT compliance into its CAMELS supervisory framework for banks, meaning that compliance deficiencies now directly affect institutional risk ratings. And ESAAMLG's scrutiny of Kenya's mutual evaluation follow-up progress has created international accountability for what was previously regarded as a domestic matter.

For compliance officers, MLROs, and board risk committees at Kenya's banks, microfinance banks, SACCOs, and payment service providers, this environment demands that POCAMLA and POTA compliance be treated as a strategic priority — not a back-office administrative function.

This guide provides a comprehensive, practical reference for understanding and meeting your institution's obligations under Kenya's principal AML/CFT legislation. It covers the legal architecture, who qualifies as a reporting institution, the specific duties around STRs and CTRs, penalties, customer due diligence requirements, record-keeping obligations, and how to build a genuinely compliant workflow that will withstand regulatory examination.

For technical guidance on filing CTRs and STRs through the FRC's goAML portal, including XML schema requirements and Kenya-specific localisation rules, see our companion article: Kenya FRC goAML Reporting: Complete Guide 2026. For threshold-specific detail and the FRC's position on same-day sub-threshold transactions, see our Kenya CTR Threshold: The USD 15,000 Rule Explained.

Kenya's AML/CFT Legal Architecture

Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) 2009 — Scope and Amendments

The Proceeds of Crime and Anti-Money Laundering Act, 2009 (POCAMLA) is Kenya's foundational AML statute. Enacted after Kenya's initial FATF-style review identified gaps in the existing legal framework, POCAMLA created a comprehensive regime covering: the criminalization of money laundering; the establishment of the Financial Reporting Centre (FRC); the obligations of reporting institutions to file STRs and CTRs; customer due diligence requirements; record-keeping duties; and the FRC's powers of supervision, investigation, and enforcement.

POCAMLA has been amended several times since 2009. The most consequential amendments were introduced through the Statute Law (Miscellaneous Amendments) Acts and the Anti-Money Laundering and Combating of Terrorism Financing Laws (Amendment) Act, 2023 (Act No. 10 of 2023), in force from 15 September 2023. Further amendments followed in 2025, through the Anti-Money Laundering and Combating of Terrorism Financing Laws (Amendment) Act, 2025 (Act No. 6 of 2025), the Gambling Control Act, 2025 and the Virtual Asset Service Providers Act, 2025. The 2023 amendments are the most significant update to the Act since its enactment and introduce several provisions with direct operational impact on reporting institutions:

Expanded FRC administrative sanction powers: The FRC can now impose civil penalties without requiring criminal prosecution, making enforcement faster and more certain
Enhanced beneficial ownership requirements: Reporting institutions are now obligated to verify and record the beneficial owners of all legal entity customers, with enhanced requirements for entities in high-risk sectors
Legal professionals and a self-regulatory body: The 2023 amendments made the Law Society of Kenya the self-regulatory body for advocates, notaries and other independent legal professionals, and section 44(3) lets them file suspicious transaction reports through it. Virtual asset service providers were added later, by the Virtual Asset Service Providers Act, 2025, with effect from 4 November 2025
Clarified tipping-off provisions: The 2023 amendments clarified the scope of the tipping-off offence in section 8, confirming that a financial group can commit it and that a lawyer who tries to dissuade a client from illegal activity is not tipping off. The penalties were not changed
FRC supervisory cooperation: Enhanced provisions for cooperation between the FRC and other domestic supervisory bodies (CBK, SASRA, CMA, IRA) and foreign financial intelligence units

Compliance teams must ensure that their policies and procedures reflect the 2023 amendments. Institutions operating under policies last updated before 2023 may be materially out of compliance.

Prevention of Terrorism Act (POTA) 2012 — How It Links to AML Reporting

The Prevention of Terrorism Act, 2012 (POTA) is Kenya's primary counter-terrorism financing (CTF) legislation. While POCAMLA addresses money laundering broadly, POTA specifically creates offences related to terrorism and terrorism financing — including the provision of funds or financial services that the person knows or reasonably suspects will be used for terrorism.

POTA links to AML reporting in several important ways. First, the FRC's goAML system includes terrorism financing (TF) indicator codes separate from money laundering indicators, so a suspicion of terrorism financing is reported as such. Second, targeted financial sanctions under POTA require anyone holding funds or other assets of a designated person to freeze them without delay and without prior notice once the designation is circulated. The Prevention of Terrorism (Implementation of the United Nations Security Council Resolutions on the Suppression of Terrorism) Regulations, 2026 (Legal Notice No. 172 of 2026) define "without delay" as within 24 hours of the designation at the latest, and require the freeze to be reported within 24 hours. No court order is involved.

Third, POTA's definitions of terrorism financing are broad enough to capture transactions that a compliance officer might initially view as a commercial or economic matter rather than a security concern. Financing that supports an organisation engaged in terrorism — even if the specific funds are intended for ostensibly legitimate purposes — can be within scope. Compliance officers assessing whether a TF-indicator STR is required must apply POTA's definitions, not just their intuition about whether the customer "seems like a terrorist."

Training on the interface between POCAMLA and POTA is an area where many Kenyan compliance programmes are thin. Compliance officers should receive explicit instruction on: when POTA obligations are triggered, the difference between an ML-indicator STR and a TF-indicator STR, and the special obligations, including the 24-hour asset freeze, that attach to designated persons.

CBK Prudential Guideline on Anti-Money Laundering (CBK/PG/08)

The Central Bank of Kenya's Prudential Guideline CBK/PG/08, the Guideline on Anti-Money Laundering and Combating the Financing of Terrorism (effective 1 January 2013), applies to institutions licensed under the Banking Act: banks, financial institutions and mortgage finance companies. A revised draft was published for comment in September 2026 and is not yet in force. This guideline provides operational detail on how CBK-regulated institutions should implement their POCAMLA obligations, including:

The minimum components of an institution's AML/CFT programme (policies, procedures, monitoring systems, training, internal audit, MLRO designation)
Standards for customer due diligence, including enhanced due diligence triggers and politically exposed person (PEP) requirements
Guidance on transaction monitoring systems and the escalation process for suspicious activity
Standards for the AML compliance officer function, including its authority, access to systems and records, and responsibilities
Expectations for AML/CFT governance — board oversight, management information reporting, and internal audit coverage of AML/CFT

The CBK guideline does not replace POCAMLA — it supplements it with sector-specific detail for banking institutions. SACCOs operating with front-office service activities are supervised by SASRA, which has issued equivalent AML/CFT guidance under its regulatory framework. MFIs are supervised by CBK through the Microfinance Act regime.

For compliance purposes, an institution regulated by CBK must meet the requirements of both POCAMLA (as primary legislation) and CBK/PG/08 (as implementing guidance). Where the guideline is more prescriptive than the Act, the guideline sets the practical compliance standard; where it is out of date, the Act prevails. The 2013 guideline's seven-day window for suspicious transaction reports, for example, has been replaced by the two-day deadline in section 44(2) of POCAMLA.

Relationship Between FRC, CBK, NPS, and Related Bodies

The AML/CFT supervisory architecture in Kenya involves multiple agencies with overlapping but distinct mandates, and compliance officers benefit from understanding how these bodies interact.

The Financial Reporting Centre (FRC) is the primary AML/CFT supervisor for all reporting institutions across all sectors. It receives STRs and CTRs, conducts inspections and investigations, and has enforcement powers under POCAMLA. Every reporting institution — regardless of which sector it operates in — is subject to FRC oversight for AML/CFT purposes.

The Central Bank of Kenya (CBK) supervises banks, microfinance banks, forex bureaus, payment service providers, and money remittance providers under the Banking Act, the Microfinance Act, and the National Payment System (NPS) Act. The CBK's AML/CFT supervision runs alongside (not instead of) the FRC's, and CBK examination findings on AML/CFT are shared with the FRC.

The SACCO Societies Regulatory Authority (SASRA) supervises deposit-taking SACCOs and their front-office service activities. SASRA has AML/CFT supervisory responsibility for the SACCO sector and works in coordination with the FRC.

The Capital Markets Authority (CMA) supervises securities market participants — stockbrokers, investment banks, fund managers, and collective investment schemes — for AML/CFT compliance.

The Insurance Regulatory Authority (IRA) supervises insurance companies and intermediaries.

For institutions supervised by multiple bodies — for example, a bank that is regulated by CBK for prudential purposes and by the CMA for its investment banking activities — AML/CFT requirements from each supervisor apply simultaneously. There is no "primary supervisor" exemption in AML/CFT: FRC oversight applies regardless.

Who Is a "Reporting Institution" Under POCAMLA?

Full List of Covered Entities

POCAMLA Section 2, as amended, defines "reporting institution" broadly. The full list of entities covered includes:

Financial institutions:

Licensed commercial banks and mortgage finance companies (CBK)
Licensed microfinance banks and deposit-taking MFIs (CBK)
Building societies
Licensed forex bureaus and money changers (CBK)
Licensed money remittance providers and payment service providers (CBK/NPS)
Mobile money operators (Safaricom M-PESA, Airtel Money Kenya, T-Kash)
Deposit-taking SACCOs with front-office service activities (SASRA)
Credit reference bureaus handling financial transactions
Hire purchase and leasing companies
Collective investment schemes and fund managers (CMA)
Stockbrokers, investment banks, and securities dealers (CMA)
Insurance companies and brokers when handling policy premiums or investment-linked products (IRA)

Designated non-financial businesses and professions (DNFBPs):

Real estate agencies (when acting as agent in real property transactions)
Advocates, notaries, and other independent legal professionals (when conducting designated transactions: managing client money, forming companies, purchasing real property)
Accountants who are sole practitioners, partners or employees in professional firms (when conducting designated transactions)
Casinos, including internet casinos (supervised by the Gambling Regulatory Authority, which replaced the Betting Control and Licensing Board as supervisory body from 26 August 2025)
Dealers in precious metals and precious stones (when they carry out a cash transaction with a customer of US$15,000 or more)
Trust and company service providers

Virtual asset service providers (VASPs): reporting institutions in their own right since the Virtual Asset Service Providers Act, 2025 took effect on 4 November 2025, licensed by the CBK or the Capital Markets Authority according to their activity.

POCAMLA has no category for dealers in motor vehicles, art, antiques or other luxury goods, although the Cabinet Secretary can declare further businesses or professions on the FRC's advice.

The breadth of this list means that many organisations that do not think of themselves as "financial institutions" are in fact POCAMLA reporting institutions with full STR, CTR, CDD, and record-keeping obligations.

Agent Banking — When the Agent vs. the Principal Is the Reporting Entity

Agent banking has created structural complexity for POCAMLA compliance. Under the CBK's Agent Banking Guidelines, commercial banks may engage third parties (retail outlets, post offices, supermarkets) as agents to conduct specified banking transactions on the bank's behalf.

The POCAMLA reporting obligation sits with the principal — the licensed bank — not the individual agent. Agents are acting as an extension of the bank's channel network, and the bank remains responsible for ensuring that transactions conducted through its agents are captured in its threshold monitoring and suspicious activity detection systems.

However, this does not mean agents are completely outside the POCAMLA framework. If an agent independently provides financial services beyond its agency mandate, or if the agent operator is independently a reporting institution (for example, a supermarket chain that also offers its own stored-value product), then separate reporting obligations may arise.

The practical consequence for banks is that their AML/CFT monitoring systems must integrate agent transaction data with branch and digital channel data. A bank that can only see its branch transactions is blind to a significant portion of its customer activity.

Exemptions and De Minimis

POCAMLA does not provide broad exemptions from the reporting regime, but several categories of transactions and institutional relationships receive different treatment:

Interbank transactions: Transactions between regulated reporting institutions for their own account (not on behalf of customers) are not subject to the standard CTR threshold, though suspicious activity reporting obligations still apply
Government payments: Certain prescribed government receipts and payments may be treated differently — compliance officers should consult FRC guidance notes for current applicable exemptions
Intra-group transactions: Transactions between entities within the same financial group, where both entities are reporting institutions, are treated more leniently in some respects, though suspicious activity reporting obligations remain
Low-risk products: Certain financial products designated as low-risk (some basic bank accounts with strict transaction limits) may be subject to simplified CDD requirements, though not exempted from suspicious activity reporting

The FRC has emphasised that institutions should not apply exemptions expansively. When in doubt about whether a transaction or relationship falls within an exemption, the safer compliance position is to apply the standard CDD and reporting requirements.

STR Obligations Under POCAMLA

Section 44 — The Duty to Report

Section 44 of POCAMLA imposes the primary STR obligation on reporting institutions. Section 44(1) requires them to monitor complex, unusual, suspicious, large and other transactions on an ongoing basis, and section 44(2), as amended with effect from 15 September 2023, requires a reporting institution to:

report the suspicious or unusual transaction or activity to the Centre in the specified manner within two days after the suspicion arose.

Section 44(3) extends the duty to attempted transactions, and advocates, notaries and other independent legal professionals may report through the Law Society of Kenya.

The obligation in section 44 is not permissive — it is mandatory. A reporting institution does not have discretion to decide whether to file an STR once a suspicion has arisen. The formation of suspicion creates an immediate legal duty.

Because section 44(2) covers suspicious or unusual activity as well as individual transactions, a pattern of individually unremarkable transactions can collectively trigger an STR obligation, even if no single transaction is independently suspicious.

What "Suspicion" Means — Reasonable Grounds vs. Certainty

One of the most common compliance misunderstandings in Kenya is the belief that a compliance officer must be certain — or close to certain — that money laundering is occurring before filing an STR. This is incorrect: the duty in section 44(2) runs from the moment a suspicion arises, not from proof.

The practical test is whether there are reasonable grounds to suspect — a substantially lower bar than certainty or even probability. Reasonable grounds exist when there is an objective, articulable basis for suspicion: specific facts about the transaction, the customer, or the pattern of activity that a reasonable compliance professional would find concerning. The compliance officer does not need to have investigated and confirmed the suspicion. She does not need to know how the money laundering scheme works. She needs to have a rational, fact-based reason to think that the transaction may be connected to money laundering or a related offence.

Factors that typically constitute reasonable grounds include: transactions inconsistent with the customer's stated business; unusual transaction structuring; transactions involving sanctioned jurisdictions or sanctioned persons; customer reluctance to explain the source of funds or purpose of transactions; patterns that match known typologies; and customer information that does not withstand basic verification.

Filing an STR where reasonable grounds exist is a protected act under POCAMLA — the reporting institution and its officers have statutory immunity from civil liability for making the report in good faith. Failing to file an STR where reasonable grounds exist exposes the institution and its officers to criminal liability.

Two-Day Filing Window From Formation of Suspicion

The prescribed period for STR filing under POCAMLA is two days after the suspicion arose (section 44(2)), and regulation 38(1) of the Proceeds of Crime and Anti-Money Laundering Regulations, 2023 says the same. Before 15 September 2023 the Act allowed seven days from the date of the transaction, and one FRC guidance note dated May 2025 still repeats that older rule; the Act and the Regulations govern. POCAMLA does not say how the two days are counted, so build your process to file well inside the window rather than relying on weekends or public holidays being excluded.

The clock starts when a compliance officer forms the suspicion, not when the investigation is concluded. This is deliberate: the FRC wants STRs filed promptly, while the transaction is fresh. An institution that investigates a suspicious transaction for two weeks and then files an STR at day 20 has breached the filing deadline regardless of the quality of the report it ultimately produces.

This has an important practical implication: the STR workflow must be designed to complete case preparation, internal review, approval, XML generation, and FIU submission within two days. For institutions without automation, this is extremely challenging, particularly for complex cases. For institutions with an automated platform, where the case is pre-populated with transaction data and customer identity, and the compliance officer's task is review, narrative drafting, and approval, filing within two days is operationally achievable for the vast majority of cases.

Mandatory STR Content: Narrative, Indicators, Subject ID

A complete and valid STR must contain:

Subject identification:

Full legal name as on identity document
National ID number (8-digit for Kenyan nationals), or Passport (for non-nationals)
Huduma Namba where registered
Date of birth
Physical address (including county)
Occupation or nature of business
Tax PIN (KRA PIN) — strongly recommended; required for business customers
Relationship to the reporting institution (account holder, third-party beneficiary, etc.)

Transaction detail:

All transactions connected to the suspicious activity
For each transaction: amount, currency, date, time, type, reference, branch/channel
Account numbers and types of all involved accounts
Counterparty details where identifiable

Indicators:

At least one goAML-coded indicator from the FRC's approved taxonomy
Indicators must accurately characterise the type of suspicious behaviour (structuring indicators, TF indicators, PEP indicators, etc.)

Narrative:

A factual, specific, and sufficient account of the basis for suspicion
Describing the transactions, explaining why they are inconsistent with the customer's profile, noting any customer explanation received and its inadequacy, and connecting the behaviour to a typology where possible
For TF-indicator STRs: enhanced narrative with specific reference to the TF typology, any connections to designated persons or entities, and any account restriction actions taken

Tipping-Off Prohibition (Section 8) and Its Criminal Consequences

Section 8 of POCAMLA makes it an offence for a person who knows, or ought reasonably to have known, that a report under section 44 is being prepared, has been sent or is about to be sent to the FRC to disclose information relating to that report to another person. Regulation 41 of the 2023 Regulations adds a separate prohibition on disclosing suspicious-transaction information to unauthorised persons. In practice, it is a criminal offence to:

Tell the subject of an STR that a report has been or will be filed in relation to their transactions
Tell any other person information from which the subject could deduce that a report has been filed

The prohibition applies to all officers and employees of the reporting institution — not just the compliance team. A teller, relationship manager, branch manager, or call centre agent who mentions to a customer that "we had to report your account" has committed a criminal offence under POCAMLA.

The penalties are substantial. Under section 16(2), an individual faces imprisonment of up to seven years, a fine of up to KES 2.5 million, or both, and a body corporate faces a fine of up to KES 10 million or the value of the property involved, whichever is higher. These penalties were not changed by the 2023 amendments. Breaching the tipping-off prohibition in regulation 41 carries the general penalty for breaching the Regulations: a fine of up to KES 5 million, imprisonment of up to three years, or both (regulation 48).

The practical training requirement is clear: all customer-facing staff must know that if a customer ever asks why their account has been frozen or why they are being asked for additional information, the correct response is to say that the bank cannot discuss the details for legal reasons — and immediately escalate to the compliance team. Under no circumstances should staff confirm or deny that a report has been filed.

CTR Obligations

USD 15,000 Threshold and Its Legal Basis

Kenya's Cash Transaction Report threshold is established under POCAMLA Section 44(6) and Regulation 40(1) of the Proceeds of Crime and Anti-Money Laundering Regulations, 2023 (POCAMLR). It requires every reporting institution to file a CTR with the FRC on every cash transaction of US$15,000 or more, or its equivalent in any other currency, whether or not the transaction appears to be suspicious. The current threshold was introduced by the Anti-Money Laundering and Combating of Terrorism Financing Laws (Amendment) Act 2023 (effective 15 September 2023), which raised the figure from USD 10,000 to USD 15,000, and was operationalised by POCAMLR gazetted on 6 October 2023 and by Financial Reporting Centre Circular No. 4 of 2023 dated 19 October 2023.

Neither the Act, the 2023 Regulations nor FRC Circular No. 4 of 2023 defines "cash transaction" or mentions mobile money. Cash ordinarily means physical currency — banknotes and coins — so electronic transfers, cheque deposits and card transactions are not cash transactions. Where mobile-money cash-in or cash-out flows through your institution, confirm the CTR treatment with the FRC rather than assuming either way. See our Kenya CTR Threshold: The USD 15,000 Rule Explained for full technical detail on the threshold, foreign currency conversion, the FRC's position on same-day sub-threshold transactions, and the filing deadline.

Filing a CTR does not imply that the transaction is suspicious. The vast majority of CTRs involve entirely legitimate business activity — cash-intensive traders, supermarkets, petrol stations, pharmacies, and other businesses that routinely handle large amounts of physical cash. CTRs are a financial intelligence input, not an accusation.

Friday-of-Week Filing Requirement

Regulation 40(3)(c) of POCAMLR requires that the CTR be submitted to the FRC by the Friday of the week in which the qualifying transaction was conducted, through the goAML application at https://goaml.frc.go.ke. The Financial Reporting Centre Circular No. 4 of 2023 confirms this position.

The deadline is calculated from the transaction date — the date the cash was deposited or withdrawn. A transaction on Monday must be reported by the same Friday (four business days); a transaction on Thursday gives effectively one business day to detect, prepare, approve, and submit.

This compressed window makes real-time or near-real-time threshold monitoring a practical necessity. Institutions that rely on weekly batch reviews of transaction data cannot reliably meet the Friday-of-week deadline without automation.

Same-Day Sub-Threshold Transactions: The FRC's Position

The FRC's position — set out in paragraph 4.3 of Financial Reporting Centre Circular No. 4 of 2023 — is that where multiple cash transactions are carried out in a day in a single account and each transaction individually falls below the reporting threshold, the reporting institution shall not aggregate those transactions for CTR purposes. A CTR is triggered by an individual cash transaction of US$15,000 or more, or its equivalent.

Where the pattern of sub-threshold transactions appears to be unusual or suspicious — for example, deliberate splitting to stay below the threshold — the Circular says the institution should seek to understand the reasons and, if the pattern is unusual or suspicious, file a Suspicious Transaction or Activity Report (STR/SAR) under POCAMLA and POCAMLR, not a CTR (Circular §4.4). This separates the two pathways clearly: CTR is per-transaction and objective; structuring monitoring is pattern-based and leads to an STR.

Effective implementation of both pathways requires: a centralised customer identifier (National ID or CIF) that is used consistently across all branches and channels; real-time or near-real-time transaction data across channels; per-transaction threshold detection against the USD 15,000 equivalent; and a separate structuring-pattern surveillance capability that surfaces cases for STR review.

Penalties for Non-Compliance

Criminal Penalties for Officers

POCAMLA imposes criminal liability on the officers and employees of reporting institutions who wilfully fail to comply with their reporting obligations. Specific criminal offences and penalties include:

Failure to report (STR/CTR): Wilfully failing to make a report required by section 44(2) is an offence under section 5, and section 11(1), as substituted in 2025, makes any failure to comply with sections 44, 45, 46, 47 and 47A or the Regulations an offence. Under section 16(2), an individual faces imprisonment of up to seven years, a fine of up to KES 2.5 million, or both; a body corporate faces a fine of up to KES 10 million or the value of the property involved, whichever is higher
Tipping-off: The same section 16(2) penalties apply to the tipping-off offence in section 8
Obstruction of FRC inspectors: Obstructing or misleading FRC inspectors carries imprisonment of up to three years or a fine of up to KES 1 million for an individual, and a fine of up to KES 5 million for a body corporate (section 35(3))
False or malicious reporting: Misrepresentation and malicious reporting (sections 9 and 10) carry imprisonment of up to two years or a fine of up to KES 1 million for an individual, and a fine of up to KES 5 million or the value of the property involved for a body corporate (section 16(4))
Breaching the Regulations: Breaching the POCAML Regulations, 2023 carries a fine of up to KES 5 million, imprisonment of up to three years, or both (regulation 48)

The criminal liability of officers is personal. It does not require that the institution itself be convicted. A compliance officer who personally fails to file a required STR — or who instructs staff not to file — faces prosecution regardless of whether the institution takes any action.

Civil Penalties on Institutions

In addition to the criminal regime, POCAMLA as amended gives the FRC powers to impose administrative penalties on reporting institutions without the need for criminal prosecution. Under section 24B, which was widened in 2023 and, in 2025, extended to breaches of the Act itself as well as the FRC's instructions, directions, rules and guidelines, the FRC can impose monetary penalties of:

Up to KES 5 million for a natural person
Up to KES 25 million for a corporate body
KES 10,000 a day for continuing failure, for up to 180 days

The FRC must first give at least 14 days' written notice to show cause, and a penalty is payable within 14 days as a debt due to the FRC. Under section 24C it can also issue a warning, order compliance with its instructions, bar individuals from employment at the institution, or ask the licensing authority to suspend or revoke a licence. There is no fixed per-report scale and no penalty calculated as a percentage of the transaction value.

The FRC has begun to publish the penalties it imposes (see the examples below). Institutions that have historically viewed AML/CFT non-compliance as a low-risk administrative matter should revise that assessment.

CBK Supervisory Actions

For institutions supervised by the CBK, AML/CFT compliance failures identified during examination can trigger a range of supervisory responses beyond FRC penalties:

Formal direction: CBK issues a written direction requiring the institution to remedy the identified deficiency within a specified timeframe, with quarterly progress reporting
Composite risk rating downgrade: AML/CFT compliance is a component of the CBK's supervisory risk assessment. A downgrade can affect the institution's capital adequacy requirements and supervisory treatment
Enhanced supervision: Increased frequency of CBK inspection visits, with mandatory quarterly meetings between CBK supervisors and senior management
Business restrictions: Limitations on new product launches, branch openings, or customer onboarding until AML/CFT deficiencies are remediated
Consent orders: Public, legally binding agreements to remediate identified deficiencies, which become part of the institution's public regulatory record
Licence conditions: Conditions attached to the banking licence that restrict the institution's business activities
Licence revocation: In cases of extreme or persistent non-compliance, the CBK can revoke a banking licence — the most severe sanction in the supervisory toolkit

Published FRC Penalties in Kenya

The FRC's published penalty notices do not name the institutions involved. The two it had published by mid-2026 were:

November 2025: a penalty of KES 200,000 on a casino operator that had not completed remedial actions after an onsite inspection, covering its AML/CFT policies, customer and enhanced due diligence, and the lack of an independent audit
April 2026: a penalty of KES 250,000 on a real estate agency that had not supplied documents the FRC required for offsite monitoring

Neither concerned STR or CTR filing, and both were far below the statutory maximums. They still show that the FRC is using its administrative powers, and the 2025 amendments extended those powers to breaches of the Act itself. Institutions should treat the compliance programme as a genuine operational necessity.

Customer Due Diligence as Prerequisite for Good Reporting

KYC Data Quality and Its Impact on XML Submission

Customer due diligence (CDD) and AML reporting are inseparable. The quality of the STR and CTR submissions your institution files through goAML is directly determined by the quality of the KYC data your institution holds on its customers.

If your KYC records lack a customer's National ID number, you cannot produce a schema-valid CTR XML for that customer. If your records contain an incorrectly formatted date of birth, the CTR will fail validation. If your address records contain only a post office box, you cannot satisfy the FRC's requirement for a physical address.

Many CTR and STR rejections at the FRC portal are not caused by problems with the transaction data — they are caused by poor underlying KYC data that cannot populate the mandatory XML fields correctly. Remedying this requires a KYC data quality programme, not just an XML generation improvement.

National ID and Huduma Namba Requirements

For Kenyan national customers, the National ID number is mandatory in every CTR and STR submission. The Kenya National ID is an 8-digit number printed on the national identity card. It must be entered without spaces, hyphens, or any prefix. Incorrect formatting is the single most common cause of individual field validation failures at the FRC portal.

The Huduma Namba — Kenya's national integrated identity management number — is accepted as an additional identifier where a customer has been registered. It does not replace the National ID; it supplements it. Institutions should capture the Huduma Namba at onboarding where the customer has one.

For foreign nationals, a Passport number is mandatory, along with the country of issue and expiry date. For corporate customers, the KRA PIN and Certificate of Incorporation number are mandatory.

Institutions should audit their KYC records regularly against these requirements. A periodic quality check that identifies customers whose National ID is missing, incorrectly formatted, or recorded only as a placeholder value will reveal the scope of the data quality problem before it manifests as a rejected submission.

Beneficial Ownership for Entities

Section 45(4)(b) of POCAMLA requires reporting institutions to identify and verify the beneficial owners of their customers, and FRC Circular No. 5 of 2023 says beneficial ownership identification is required regardless of the customer's risk level. The 2023 Regulations define a beneficial owner as "a natural person who ultimately owns or controls a customer or the natural person on whose behalf a transaction is being conducted", including any natural person who ultimately exercises effective control over a legal person or arrangement. There is no percentage threshold: for legal persons, regulation 16(2) looks first for a controlling ownership interest, then for control exercised by other means, and finally for the senior managing official. The 10% test in the Companies (Beneficial Ownership Information) Regulations governs companies' own beneficial ownership registers, not customer due diligence under POCAMLA.

Beneficial ownership information must be captured at onboarding and updated whenever there is a change in the entity's ownership structure. For STR submissions involving a legal entity, beneficial ownership information must be included in the XML submission.

Many Kenyan financial institutions' KYC systems do not currently capture beneficial ownership data in a structured way — it may be noted in free-text fields, scanned document attachments, or not captured at all. POCAMLA and the 2023 Regulations make beneficial ownership identification a regulatory requirement, FRC Circular No. 5 of 2023 says the information must be kept for at least seven years, and institutions that have not yet updated their onboarding systems to capture it in a structured way should do so as a priority.

Enhanced Due Diligence Triggers

POCAMLA and the CBK's Prudential Guideline require enhanced due diligence (EDD) for certain categories of customer relationships and transactions. EDD triggers include:

Politically Exposed Persons (PEPs): Regulation 26 of the 2023 Regulations requires enhanced measures for every foreign PEP: risk-management systems to identify them, senior management approval to establish or continue the relationship, reasonable measures to establish source of wealth and source of funds, and enhanced ongoing monitoring. For domestic PEPs and people with a prominent function at an international organisation, institutions must take reasonable measures to identify them and apply those enhanced measures where the relationship is higher risk. Immediate family members and close business associates of PEPs are PEPs too (regulation 26(5))
High-risk jurisdictions: Section 45A(1)(a) of POCAMLA requires EDD for countries that the FATF identifies as having strategic deficiencies and that have not made sufficient progress or committed to an action plan. The FATF does not call for EDD on jurisdictions under increased monitoring (the "grey list"), so assess those on a risk basis. Institutions must also send the FRC a yearly list of customers from higher-risk countries (section 45A(3)(e))
Correspondent banking: Banking relationships with other financial institutions (particularly for cross-border payments) require EDD including assessment of the respondent institution's AML/CFT programme
Shell companies and complex ownership structures: Entities with complex or opaque ownership structures, or entities whose ultimate beneficial owner cannot be identified, require EDD
High-risk business types: Cash-intensive businesses, money service businesses, dealers in high-value goods, and businesses operating in sectors with known ML/TF risk profiles require EDD

EDD does not prevent an institution from serving these customers — it requires a higher standard of diligence, documentation, and ongoing monitoring. Critically, even customers who have passed EDD remain subject to suspicious activity monitoring and STR obligations.

Record-Keeping Obligations

Seven-Year Retention Requirement

Section 46(4) of POCAMLA requires reporting institutions to keep transaction and identification records "for a period of at least seven years or such longer period as the Centre may in writing require", counted from the date the relevant business or transaction was completed or following the termination of an account or business relationship. Regulation 42 of the 2023 Regulations applies the same seven-year minimum to customer due diligence records, account files, business correspondence and the results of any analysis, and written findings on complex or unusual transactions must also be kept for at least seven years (section 44(4) and (5)).

The seven-year retention period applies regardless of whether the transaction generated a CTR or STR. Every transaction must be recorded and retained. This requirement has significant implications for data storage and management — core banking systems must be configured to retain transaction history for at least seven years, and KYC records must be retained for at least seven years after the relationship ends.

For STR and CTR submissions, institutions should retain copies of submitted XML files, submission receipts, and the case documentation (case notes, approval records, narrative drafts) for at least seven years, in line with regulation 42. This documentation must be producible on FRC request — institutions that cannot produce copies of their submitted reports risk a finding of record-keeping failure even if the reports were originally filed correctly.

Audit Trail Standards Under POCAMLA

POCAMLA and the CBK Prudential Guideline both require reporting institutions to maintain audit trails that evidence their compliance with AML/CFT obligations. The audit trail for an STR or CTR should demonstrate:

When the transaction occurred
When the threshold breach or suspicious activity was detected
When the case was escalated to the compliance function
When the compliance officer reviewed the case
When the report was approved by authorised management
When the report was submitted to the FRC
Whether the submission was accepted or rejected
If rejected, when the correction was made and resubmission filed

This level of documentation requires a systematic compliance management process — not ad hoc email chains or spreadsheets.

What Regulators Look for During Inspections

When the FRC or CBK conducts an AML/CFT inspection of a reporting institution, the examination team will typically request:

A sample of CTR and STR submissions from the past 12 months, with the case files showing the detection, review, and approval process for each
Evidence that all threshold-triggering transactions during the inspection period generated CTR cases — inspectors may pull transaction data from the core banking system and compare it to submitted CTRs
Statistics on filing timeliness — the average and distribution of days between transaction date and CTR submission, and between suspicion-formation date and STR submission
Training records for all compliance and customer-facing staff
Board and management reporting on AML/CFT programme performance
Policies and procedures for suspicious activity identification and escalation
Evidence of the internal audit function's coverage of AML/CFT

Institutions that can produce all of this documentation quickly, in organised form, from a compliance management system perform significantly better in inspections than those that must manually assemble records from email archives and spreadsheets.

Building a POCAMLA-Compliant Workflow

Analyst to Compliance Officer to Approval to Submission

A POCAMLA-compliant STR workflow should follow a structured, documented sequence:

Step 1 — Detection: A transaction monitoring alert is generated (for pattern-based suspicious activity) or a teller, relationship manager, or compliance analyst identifies a potential suspicious activity and creates a case.

Step 2 — Initial analysis: A compliance analyst reviews the alert, gathers relevant transaction history, customer profile information, and any available counterparty data. The analyst prepares an initial assessment noting the basis for suspicion.

Step 3 — Escalation decision: The analyst determines whether the case should be escalated as an STR, closed with documentation of the reason, or referred for enhanced due diligence before a filing decision is made. If the decision is to file, the analyst prepares the draft STR case including the narrative.

Step 4 — Compliance Officer review: The MLRO or a designated senior compliance officer reviews the draft STR — assessing the sufficiency of the basis for suspicion, the quality of the narrative, the accuracy of the indicator selections, and the completeness of the subject identification. The Compliance Officer approves or rejects the draft, with rejection accompanied by specific feedback for the analyst.

Step 5 — XML generation and pre-validation: The approved case is converted to goAML-schema XML and validated against the FRC's validation rules before submission.

Step 6 — Submission: The validated XML is submitted to the FRC goAML portal. Submission confirmation is logged in the case file.

Step 7 — Post-submission: The submission status (accepted or rejected) is recorded. Rejected submissions are corrected and resubmitted. Accepted submissions are archived with the complete case documentation.

Each step must be documented with timestamps and user identities. This documentation is the evidence that your compliance programme functions as designed.

Technology and Documentation Best Practices

The compliance workflow described above cannot be reliably implemented through manual processes at any scale. An automated compliance management platform:

Triggers case creation automatically from core banking alerts or manual notification
Pre-populates case fields with customer and transaction data from the core banking system
Guides the analyst through the required analysis steps with structured templates
Enforces mandatory field completion before escalation is permitted
Routes cases through the approval workflow with automated notifications
Generates schema-valid XML with pre-submission validation
Submits to the FRC portal and logs the submission confirmation
Maintains an immutable audit trail of every action, automatically

Beyond the workflow benefits, a compliance management platform also produces the management information that POCAMLA compliance requires: filing volume statistics, timeliness metrics, rejection rates, and outstanding case pipeline — all reportable to senior management and the board in real time.

Training Requirements for Staff

POCAMLA and the CBK Prudential Guideline require AML/CFT training for all relevant staff. The FRC's guidance on training requirements specifies:

All staff: Annual awareness training covering: what money laundering and terrorism financing are, why the institution is required to comply, what red flags look like in everyday transactions, and the tipping-off prohibition
Customer-facing staff: Additional training on CDD requirements, PEP identification, and the escalation process for suspicious activity
Compliance team: In-depth training on POCAMLA obligations, goAML reporting requirements, indicator taxonomy, narrative standards, and the approval workflow
Senior management and board: Training on governance obligations, management information requirements, and the consequences of non-compliance

Training records must document: the training programme content, the date delivered, the names and roles of attendees, and the results of any assessment or test conducted. These records must be available for inspection by the FRC and CBK.

The FRC has noted in inspection findings that many institutions provide annual awareness training but cannot demonstrate that the training content covered current regulatory requirements — particularly the 2023 POCAMLA amendments. Training programmes should be reviewed and updated following every significant regulatory change.

Build Your POCAMLA-Compliant Programme with Creodata

POCAMLA compliance in 2026 is not a compliance department issue — it is a business continuity issue. The penalties are real, the enforcement is active, and the reputational and correspondent banking consequences of being associated with AML/CFT failures are severe.

Building a genuinely POCAMLA-compliant AML reporting programme requires more than well-written policies. It requires a technology platform that automates threshold detection, enforces the reporting workflow, generates schema-valid goAML XML, and maintains an immutable audit trail that stands up to FRC inspection and ESAAMLG mutual evaluation scrutiny.

Creodata's goAML AML Reporting Platform is purpose-built for Kenya's regulatory requirements — handling the full compliance lifecycle from per-transaction USD 15,000-equivalent CTR detection through structuring-pattern surveillance, multi-level STR approval, FRC portal submission, and immutable case documentation. It is the same platform supporting institutions in Zambia, Uganda, Tanzania, and Rwanda, with country-specific profiles for each FIU.

See how Creodata transforms POCAMLA compliance — request your demo at creodata.com/demo.

Frequently asked questions

What is the STR filing deadline under POCAMLA?

Within two days after the suspicion arose, under section 44(2) of POCAMLA and regulation 38(1) of the 2023 Regulations. The clock starts when suspicion is formed, not when an internal investigation ends; a report filed on day 20 after two weeks of investigation is late regardless of its quality. The Act does not say how the two days are counted, so plan to file well inside the window.

What does “reasonable grounds to suspect” mean?

An objective, articulable basis for suspicion — specific facts about the transaction, the customer or the pattern that a reasonable compliance professional would find concerning. Certainty is not required and neither is a completed investigation. Filing in good faith is protected by statutory immunity; failing to file where reasonable grounds exist exposes the institution and its officers to criminal liability.

What are the penalties for failing to report under POCAMLA?

Wilfully failing to file a required report, and tipping-off, are punishable under section 16(2) by imprisonment of up to seven years, a fine of up to KES 2.5 million, or both for an individual, and a fine of up to KES 10 million or the value of the property involved, whichever is higher, for a body corporate. Separately, the FRC can impose monetary penalties without prosecution under section 24B: up to KES 5 million for a natural person, up to KES 25 million for a corporate body, and KES 10,000 a day for up to 180 days while a failure continues. Breaching the 2023 Regulations carries a fine of up to KES 5 million, imprisonment of up to three years, or both (regulation 48).

What is the CTR threshold and deadline under POCAMLA?

US$15,000 or more, or its equivalent in any other currency, per cash transaction, reported to the FRC by the Friday of the week in which the transaction occurred (Regulation 40(3)(c) of the 2023 Regulations, confirmed by FRC Circular No. 4 of 2023). Same-day sub-threshold cash transactions in a single account are not aggregated for CTR purposes; suspected structuring goes through the STR pathway.

Who is a reporting institution under POCAMLA?

Banks, microfinance banks, SACCOs with front-office services, forex bureaus, money remittance providers, payment service providers, insurers, capital-markets intermediaries, the designated non-financial businesses and professions the Act names (casinos, real estate agencies, dealers in precious metals and stones, accountants, trust and company service providers, and advocates, notaries and other independent legal professionals), and, since 4 November 2025, virtual asset service providers. Agents report through their principal; the section above sets out the full list and the de minimis exemptions.