Suspicious Transaction Reports in Zambia: The FIC's Three-Working-Day Rule, Filing and Tipping-Off (2026)

Short answer: A Zambian reporting entity that suspects, or has reasonable grounds to suspect, that property is the proceeds of crime or is linked to terrorism or proliferation must report to the Financial Intelligence Centre (FIC) "not later than three working days after forming the suspicion" (section 29 of the Financial Intelligence Centre Act, 2010). Attempted transactions count. The prescribed form says to send the report "Via the Online Portal", using email or post only in exceptional circumstances. Tipping off is an offence.

This guide is for compliance officers, money laundering reporting officers (MLROs), analysts and branch staff at Zambian banks, non-bank financial institutions, insurers, securities firms, money transfer businesses, bureaux de change, casinos, virtual asset service providers (VASPs) and designated non-financial businesses and professions (DNFBPs). It is a practical guide, not legal advice. The Act, the Financial Intelligence Centre (General) Regulations, 2022 (SI No. 54 of 2022) and the FIC's guidance are the authoritative texts.

---

When the duty arises

Section 29(1) of the Act applies to a reporting entity, and to a director, principal officer, partner, professional or employee of a financial service provider. Each must report to the FIC when they suspect, or have reasonable grounds to suspect, that property is the proceeds of crime or is linked to terrorism or proliferation.

The duty reaches beyond completed transactions:

• Attempted transactions. Section 29(2): "Subsection (1) shall apply to attempted transactions."
• Due diligence that cannot be completed. The entity "shall not open the account, commence business relations or perform the transaction", and "shall make a suspicious transactions report in relation to the customer" (section 16(9)).
• Due diligence that would tip off the customer. The entity "shall not conduct customer identification and verification, and instead shall file a suspicious transaction report under this Act" (section 16(10)).
• Lawyers, notaries and accountants. Section 29(3) sets out when they must report, and carves out privileged information.

The FIC's 2023 sector guidelines add: "Although the existence of a single indicator does not necessarily indicate illicit activity, it should encourage further monitoring and examination."

---

The three-working-day clock

The deadline runs from forming the suspicion, not from the transaction. The prescribed forms repeat it: "Please submit completed STR to FIC not later than three working days of forming the suspicion". For entities the Bank of Zambia licenses or designates, Directive 5 of its 2017 AML Directives says the same: report "within three (3) working days of forming that suspicion".

The internal route has to fit inside those three days:

Time-stamp each step. The record shows when the suspicion was formed, and why an alert was closed without a report.

---

Do not carry out the transaction

Since 2020, section 29(4) reads: "A reporting entity shall refrain from carrying out a transaction which it suspects to be related to money laundering, financing of terrorism or proliferation or any other serious offence relating to money laundering, financing of terrorism or proliferation."

The FIC can then act. Its Director-General may order a reporting entity to freeze an account or suspend a transaction "for a period not exceeding fifteen days" (section 10(3)). During a freeze the entity must "stop all activity on the account concerned with the exception of credits received into that account" (SI No. 54 of 2022, regulation 6(3)). In 2024 the FIC froze 34 bank accounts and 10 mobile-money accounts.

---

How to file

Regulation 17 of SI No. 54 of 2022 prescribes Form IV for financial service providers and Form V for DNFBPs, sent by confidential cover: electronically, to an address the FIC designates, or by courier or in person. The report "shall contain a full description of the suspicious transaction and state the reason why it is considered suspicious" (regulation 17(2)).

The forms set the order of preference. Send the form "Via the Online Portal". Only in exceptional circumstances, email it to FICSTR@fic.gov.zm or post it to the Director General, Financial Intelligence Centre, P.O. Box 30481, Lusaka. The FIC's 2023 sector guidelines add: "The designated Compliance Officer is responsible for the submission of STRs to the Centre."

The FIC's goAML portal, goaml.fic.gov.zm, describes itself as "for electronic submission of various reports to the FIC", and you must log in to submit: see our FIC goAML registration guide. On 1 October 2026 the portal took up to 500 transactions and 10 attachments per report, with goAML XML schema version "5.0". Its report-type codes are visible only after login. The FIC's 2022 STR Guidance Note, which lists the "FIC e-system", courier and delivery in person, predates SI No. 54 of 2022.

---

What to put in the report

The prescribed form's narrative instruction asks you to:

• "describe clearly and completely the factors or unusual circumstances that led to the suspicion";
• "indicate whether the transaction is an isolated incident or involves other transactions and provide details of other entities or persons involved in the transaction";
• say whether the matter has been reported to any law enforcement agency, and if so which.

The form also asks you to tick at least one reason for suspicion from a list of about 30, plus "Other (Specify)". Among them:

Tick the reasons the narrative supports, and make the narrative explain each one.

---

What the FIC sees most

The most-cited reasons in 2024 STRs:

The FIC also highlighted "unusually high USD-denominated cash deposits, structured deposits below the reporting thresholds" and "use of Zambian owned companies and personal accounts to conceal beneficial ownership". Splitting transactions to avoid a report is an offence in itself: see our CTR guide.

---

STR statistics and what happens next

The FIC received 8,981 STRs in 2024, a fall of 12.74% from 10,293 in 2023. It received 5,745 in 2022.

Law firms, accounting firms, real estate agents, dealers in precious stones and minerals, and trust and company service providers filed none in 2024.

That year the FIC disseminated 951 intelligence reports, 573 of them to the Zambia Revenue Authority, which made tax assessments worth ZMW 28.9 billion from 326 reports. The FIC keeps STRs for at least 15 years and should, "as far as is practicable", tell the reporting entity what action it took (sections 57 and 54(2)). Keep your own copies for at least ten years.

---

Tipping-off, confidentiality and protection

• Tipping off. A reporting entity and its directors, partners, officers, principals and employees must not disclose to the customer or a third party that a report "shall be, is being or has been, submitted to the Centre" (section 33(1)).
• The reporter's identity. No one may disclose information that identifies, or is likely to identify, the person who prepared or made an STR or handled the underlying transaction, except for the administration of the Act (section 34(1)).
• Wider disclosure. Disclosing information to a customer or a third party contrary to the Act is a separate offence (section 47).
• The board. The FIC's STR Guidance Note warns that giving the board details of individual STRs risks tipping off: "Only aggregated statistical information on the number of STRs submitted to the FIC might be reported to the Board and this will not entail tipping off."

In return, no criminal, civil, disciplinary or administrative proceedings for breach of banking or professional secrecy or contract lie against a reporting entity or its people who "in good faith" submit reports under the Act (section 35(1)). A disclosure made in compliance with the Prohibition and Prevention of Money Laundering Act, 2001 is a protected disclosure under the Public Interest Disclosure (Protection of Whistleblowers) Act, 2010.

---

Penalties

Where a company commits an offence, every director or manager is liable as if they had committed it, unless they prove lack of knowledge or reasonable steps to prevent it (section 52). This guide does not convert penalty units to Kwacha. In 2024 the FIC inspected 55 reporting entities, listed "non-reporting of STRs and CTRs" among the deficiencies it found, and imposed ZMW 1.2 million in monetary penalties.

For the wider law, see the Financial Intelligence Centre Act explained, our Zambia FIC goAML compliance guide and our buyer's guide to AML compliance software in Zambia.

---

STR checklist

1. Write the section 29 triggers into your internal rules, including attempted transactions and due diligence that cannot be completed.
2. Give staff a fast route to the designated compliance officer, and record when each internal report arrives.
3. Record when the suspicion was formed: the three working days run from then.
4. Refrain from carrying out a transaction you suspect.
5. Write the narrative the form asks for: the factors, whether the transaction is isolated, the other persons involved, and any report to law enforcement.
6. Tick every reason for suspicion that the narrative supports.
7. File on the online portal, using email or post only in exceptional circumstances.
8. Keep STRs and reporters' identities confidential, and give the board aggregated numbers only.
9. Keep copies of STRs for at least ten years.

---

Frequently asked questions

What is the STR deadline in Zambia?

Not later than three working days after forming the suspicion, under section 29(1) of the Financial Intelligence Centre Act, 2010. The clock starts at the suspicion, not at the transaction.

Do attempted transactions have to be reported?

Yes. Section 29(2) applies the STR duty to attempted transactions.

Can we email an STR to the FIC?

Only in exceptional circumstances. The prescribed form says to send it via the online portal, with email to FICSTR@fic.gov.zm or post as the exception.

Can we tell the customer, or our board, that we filed an STR?

Not the customer: tipping off is an offence under section 33. For the board, the FIC's guidance allows only aggregated statistics on the number of STRs filed.

What happens if we do not file an STR?

It is an offence under section 45, with a maximum of 700,000 penalty units, seven years' imprisonment, or both. The FIC or your supervisory authority can also impose administrative sanctions, including a financial penalty of up to one million penalty units.

How many STRs does the FIC receive?

It received 8,981 in 2024, down from 10,293 in 2023, and commercial banks filed 96.9% of them.

---

Suspicious transaction reporting with Creodata

Creodata's goAML Reporting Platform compiles parties, accounts and narrative in one STR workspace, generates schema-valid goAML XML from core-banking data, validates every report against the schema and business rules before submission, and keeps an immutable record of every report, amendment and filing. See goAML reporting software for Zambia, and AML compliance software in Zambia for the monitoring and case management behind each report.

See it on your own cases — request a demo.