Sanctions and PEP Screening in Kenya: Which Lists to Screen, the 24-Hour Freeze Rule and the Evidence to Keep
Which sanctions lists Kenyan institutions must screen, the 24-hour freeze and reporting rule, how PEPs are defined under the 2023 Regulations, and what to keep.
Short answer: Kenyan reporting institutions must screen customers, beneficial owners and transactions against the UN Security Council sanctions lists and Kenya's Domestic List, freeze a designated person's funds within 24 hours of a designation, and report the freeze within 24 hours. They must also identify politically exposed persons (PEPs) and apply enhanced due diligence to every foreign PEP and to domestic PEPs where the risk is higher. Screening software should keep lists current, explain every match and record which list version each decision used.
This guide is for MLROs, compliance analysts and the teams choosing screening tools at Kenyan banks, SACCOs, insurers, payment providers, digital lenders and DNFBPs. It draws on the primary texts as they stood on 17 September 2026, and it is a practical guide, not legal advice: sanctions rules in Kenya changed as recently as September 2026, so confirm the current position before you rely on it. Creodata sells AML compliance software built for Kenya, and we say where it fits near the end.
The legal basis for sanctions screening in Kenya
Kenya's targeted financial sanctions rest on the Prevention of Terrorism Act (Cap. 59B). The Act sets up the Counter Financing of Terrorism Inter-Ministerial Committee, chaired by the Cabinet Secretary responsible for internal security, with the Director-General of the Financial Reporting Centre (FRC) as its Secretary, and requires the Committee to implement the UN Security Council's sanctions resolutions. Making funds or financial services available to a designated person is an offence under section 30G.
Two sets of regulations turn that into day-to-day obligations for reporting institutions:
- Terrorism financing: the Prevention of Terrorism (Implementation of the United Nations Security Council Resolutions on the Suppression of Terrorism) Regulations, 2026 (Legal Notice 172 of 2026), made on 7 September 2026.
- Proliferation financing: the proliferation-financing regulations made under the same Act (Legal Notice 189 of 2023, amended in 2024), which cover UN Security Council Resolutions 1718 and 2231.
The FATF's standards behind this are Recommendations 6 and 7, which require freezing "without delay". When the FATF placed Kenya under increased monitoring in February 2024, a sanctions framework that complies with Recommendation 6 was one of the items in its action plan, and it was still listed as outstanding after the June 2026 plenary. Expect supervisors to test it.
Which lists to screen
| List | What it covers | Required in Kenya? |
|---|---|---|
| UN Security Council Consolidated List | Persons designated under the UN sanctions regimes, including ISIL (Da'esh) and Al-Qaida and the 1718 (DPRK) regime | Yes, under the terrorism and proliferation-financing regulations |
| Kenya's Domestic List | Persons designated by the Inter-Ministerial Committee under UN Security Council Resolution 1373 | Yes. The Committee maintains it, and the FRC circulates designations. The first domestic designations published on the FRC's sanctions notices page, 13 entries, were made on 4 February 2026 |
| Other national lists, such as those of the United States, the European Union and the United Kingdom | Those governments' own sanctions programmes | Not named in Kenya's sanctions regulations; many institutions screen them on a risk basis, often because correspondent banks or payment partners ask |
| PEP data | Politically exposed persons, family members and close associates | Identifying PEPs is required; the data source is your choice |
| Adverse media | Negative news about customers and counterparties | A risk-based control that supports due diligence and monitoring |
The FRC names goAML as its primary channel for sanctions notices and publishes the Domestic List on its website. Its guidance says that a delay in receiving a notice through another channel is not a sufficient defence, so someone in your institution needs to watch goAML notices, not only an email inbox.
The 24-hour freeze and reporting rule
The 2026 terrorism-financing regulations define "without delay" as within a matter of hours of a designation and in any event not later than 24 hours. The proliferation-financing regulations use the same 24-hour limit. In practice that means:
- Screen immediately when the UN or the Committee designates someone. The regulations also require ongoing screening against the Domestic List and the UN lists.
- Freeze without delay and without prior notice all funds or assets the designated person owns or controls, including jointly owned assets, assets derived from them and assets of people acting on their behalf, and do not make funds or financial services available to them.
- Report within 24 hours to the Committee, through its Secretary, including any attempted transactions. The FRC's guidance asks for its prescribed template, sent to its dedicated sanctions address, and says institutions should also consider a suspicious transaction report under section 44 of the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA).
- Unfreeze within 24 hours of a delisting or a notification that the match was a false positive.
- Do not tip off. Telling the customer that a report is being prepared or has been sent is an offence under section 8 of POCAMLA.
Penalties under the 2026 regulations include up to 10 years' imprisonment for an individual, and fines of up to KES 1 million for an individual or KES 20 million for a legal person. Under the proliferation-financing regulations, failing to report carries fines of up to KES 5 million for a natural person and KES 25 million for a legal person.
Sector rules point the same way. The Central Bank of Kenya's AML guideline for banks requires controls that detect persons designated under UN Resolution 1267, SASRA's 2024 guidelines require regulated SACCOs to check member and customer databases and transactions against sanctions lists, including beneficial owners and connected persons, the IRA's guidelines require insurers to keep a database of UN-listed names and check customers regularly, and payment service providers must use systems capable of screening transactions under the National Payment System Regulations, 2014. A draft revision of the CBK guideline, published for comment in September 2026, would require screening within 24 hours of an FRC list update, including dormant relationships; it is not yet in force.
PEPs under Kenyan law
The definition sits in regulation 26(5) of the Proceeds of Crime and Anti-Money Laundering Regulations, 2023, not in the Act. A politically exposed person is someone entrusted with a prominent public function in Kenya or another jurisdiction, including members of the Cabinet, senior executives of state-owned corporations, important political party officials, senior military officers and other senior members of the disciplined forces, members of the Judiciary, State Officers, senior public officers, senior officials of international organisations and heads of state or government, together with their immediate family members and close business associates. The FRC can add further categories.
What the law requires depends on the type of PEP:
| PEP type | Required measures (regulation 26) |
|---|---|
| Foreign PEP | Always: risk-management systems to identify them, senior management approval to establish or continue the relationship, reasonable measures to establish source of wealth and source of funds, and enhanced ongoing monitoring |
| Domestic PEP, or a person with a prominent function at an international organisation | Reasonable measures to identify them, and the enhanced measures above where the relationship is higher risk |
The FRC's Circular No. 6 of 2023 makes the same point: all foreign PEPs are high risk, and not all domestic PEPs are. No rule was found on how long someone remains a PEP after leaving office, so treat former PEPs by risk rather than by a fixed cooling-off period. For life insurance, regulation 26(3) also requires institutions to determine, by payout at the latest, whether a beneficiary or the beneficiary's beneficial owner is a PEP.
The CBK's 2025 guidance on PEPs encourages automated, continuous monitoring linked to customer due diligence data. It accepts that smaller institutions may monitor manually but warns that they risk missing suspicious transactions, and it notes that Kenya's 2022 mutual evaluation found smaller institutions lacked adequate screening systems. Whether to buy commercial PEP data is left to each institution; the guidance says such databases should add to other sources rather than replace them, and that subscription costs should not be passed on to customers. Our guide to PEP screening at account opening covers the onboarding side.
Matching Kenyan names without drowning in false positives
Name screening in Kenya has to cope with names that appear in different orders, with or without middle and clan names, in several spellings, and transliterated from Arabic, Somali or other scripts. A system that matches only exact strings misses real hits; one that matches too loosely buries analysts in look-alikes.
- Use secondary identifiers. Date of birth, nationality and ID or passport numbers resolve most potential matches quickly.
- Tune thresholds on your own data. Test a sample of known true and false matches before go-live and after each change.
- Make every hit explain itself, so the analyst can see why the system matched and close it with a reason.
- Control whitelisting. A customer cleared as a false positive should stay cleared only until their details or the list entry change, with a second approver for the decision.
The guide to reducing false positives in AML screening goes deeper, and watchlist management explains how to keep lists current and provable.
The evidence to keep
An examiner will ask whether screening ran, against which lists, and what happened next. Keep:
- The list version and time of every screening run, including rescreens after list updates.
- Each potential match, the decision, the reason and the approver.
- Freeze actions, reports to the Committee and any related suspicious transaction reports, with timestamps that show the 24-hour limits were met.
- Enhanced due diligence records for PEPs, including approvals and source-of-wealth evidence.
POCAMLA section 46(4) requires records to be kept for at least seven years from the transaction or the end of the relationship.
Choosing screening software
| Question | A good answer looks like |
|---|---|
| How quickly do UN list changes and Kenya's Domestic List reach screening? | A demonstrated update path, with version history and a log of the rescreen |
| Can we load lists we maintain ourselves? | Manual upload with versioning, for the Domestic List and internal watchlists |
| How does matching handle Kenyan and Swahili names? | Results on your own sample of true and false matches |
| Does every hit show why it matched? | Top reasons per match, and a structured false-positive workflow with approvals |
| Are beneficial owners and connected persons screened? | Screening across the ownership graph, not only the account holder |
| What PEP data is included, and what does it cost? | A clear list inventory and price, with the data licence named |
| Can we screen in real time at onboarding and on payments? | An API with published latency, plus batch rescreening |
Our free AML vendor RFP checklist includes these requirements with a scoring spreadsheet, and the buyer's guide to AML compliance software in Kenya covers the rest of the evaluation.
Where Creodata fits
Creodata's sanctions and PEP screening software is part of its AML suite. Screening covers sanctions, PEP and adverse media with fuzzy, multi-script, locale-aware name matching, shows the top three reasons behind each hit, and runs a structured false-positive workflow. Watchlist management syncs lists from commercial providers such as Dow Jones and World-Check, supports manual upload for lists such as Kenya's Domestic List, and versions every list with freshness dashboards, so you can show which list a decision used. PEP and sanctions exposure feeds the six-factor customer risk rating, higher-risk customers go through an enhanced due diligence workflow in case management, entity resolution shows the beneficial owners behind a customer, and every decision lands in an append-only audit log. Book a demo and bring a sample of your own names.
If you run a SACCO or a fintech, see AML software for SACCOs in Kenya and AML compliance for fintechs and digital credit providers.
Frequently asked questions
Which sanctions lists must Kenyan institutions screen against?
The UN Security Council sanctions lists and Kenya's Domestic List, which holds persons designated by the Counter Financing of Terrorism Inter-Ministerial Committee under UN Security Council Resolution 1373. Both are required under the Prevention of Terrorism Act and its regulations. Many institutions also screen lists not named in those regulations, such as those of the United States, the European Union and the United Kingdom, on a risk basis.
How quickly must a Kenyan institution freeze a designated person's funds?
Without delay, which Kenya's 2026 terrorism-financing sanctions regulations define as within a matter of hours and in any event not later than 24 hours after the designation. The freeze, and any attempted transactions, must then be reported within 24 hours to the Committee through the FRC. The proliferation-financing regulations apply the same 24-hour limit.
What is a politically exposed person under Kenyan law?
Regulation 26(5) of the POCAML Regulations, 2023 defines a PEP as a person entrusted with a prominent public function in Kenya or elsewhere, such as Cabinet members, State Officers, senior public officers, members of the Judiciary, senior military officers, important political party officials, senior executives of state-owned corporations, senior officials of international organisations and heads of state, plus their immediate family members and close business associates.
Do all domestic PEPs need enhanced due diligence?
No. Regulation 26 requires enhanced measures for every foreign PEP, but for domestic PEPs and people with prominent functions at international organisations it requires reasonable measures to identify them and enhanced measures only where the relationship is higher risk. Some sector rules set their own approach; SASRA's guidelines, for example, treat domestic PEPs as high risk where the SACCO's own assessment says so.
How often should customers be rescreened?
Whenever the lists change, not only on a fixed cycle. The 24-hour freeze rule means a new UN or domestic designation has to reach your customer base within hours, and the 2026 regulations require ongoing screening against the Domestic List and the UN lists. Rescreen customers too when their own details change, such as a new beneficial owner or a change of name.
Where does the FRC publish Kenya's Domestic List?
The FRC publishes the Domestic List on its website and sends sanctions notices through goAML, which its guidance names as the primary channel. The same guidance says a delay in receiving a notice through another channel is not a sufficient defence, so monitor goAML notices and make sure your screening software can take list updates the day they are published.
See how Creodata's AML compliance software screens against UN and Kenyan lists in a 30-minute demo, or score vendors with the free AML vendor RFP checklist.
