AML Compliance for Banks in Zambia: The FIC Act, SI 53 and 54 of 2022 and the Bank of Zambia's 2017 Directives (2026)
Which AML rules bind a bank in Zambia: the FIC Act 2010, SI 53 and 54 of 2022, the PPMLA and the Bank of Zambia's 2017 Directives, with the deadlines, the penalties and who supervises.
Short answer: A bank in Zambia takes its anti-money laundering duties from the Financial Intelligence Centre Act, 2010, as amended in 2016 and 2020, and from SI No. 53 of 2022 (thresholds) and SI No. 54 of 2022 (due diligence, forms and registration). The Bank of Zambia (BoZ) supervises banks' compliance; the Financial Intelligence Centre (FIC) receives the reports and can step in where a supervisor fails to act. BoZ's Anti-Money Laundering and Combating the Financing of Terrorism or Proliferation Directives, 2017 are still its current AML directives as of 1 October 2026. Two clocks matter most: a suspicious transaction report (STR) within three working days of forming the suspicion, and a currency transaction report (CTR) at or above the Kwacha equivalent of USD 10,000 within three working days of the transaction. Money laundering itself is an offence under the Prohibition and Prevention of Money Laundering Act, 2001 (PPMLA).
This guide is for compliance officers, money laundering reporting officers (MLROs), boards and IT teams at commercial banks in Zambia; our guide to the FIC Act covers every sector. It is a practical guide, not legal advice.
Who supervises a bank's AML compliance
Section 2 of the FIC Act names the Bank of Zambia among the supervisory authorities, alongside the Pensions and Insurance Authority, the Securities and Exchange Commission, the professional bodies and the FIC itself. Section 36(2) sets the job: "A supervisory authority shall monitor and ensure compliance by reporting entities with their obligations under this Act." A supervisor may compel information and impose sanctions (section 36(3)), may publish directives on reporting obligations "in consultation with the Centre" (section 36(4), the basis of the 2017 Directives), may appoint inspectors (section 36(5)) and must give the FIC its findings after every inspection (section 36(7)).
BoZ's 2024 Financial System Supervision Report describes an AML/CFT Supervision function that monitors financial and payment services providers' compliance with the FIC Act. The 2025 National Risk Assessment (NRA) says BoZ supervises commercial banks under the Banking and Financial Services Act No. 7 of 2017, read with the AML Directives issued in 2017.
The FIC is "the designated National Centre for receipt, from reporting entities, and analysis of suspicious transaction reports" (section 5(1)). Since 2020 it also supervises entities whose supervisor "fails or neglects to enforce compliance" (section 5(3)(j)), and the NRA calls it "the main regulator of the AML/CFTP for all reporting entities".
The laws in brief
| Instrument | What it does for a bank | Status |
|---|---|---|
| Financial Intelligence Centre Act, 2010 (Act No. 46 of 2010) | Establishes the FIC; due diligence, records, compliance programme, STRs, CTRs, supervision | In force; no amendment since 2020 found |
| FIC (Amendment) Acts No. 4 of 2016 (assent 5 April 2016) and No. 16 of 2020 (assent 11 December 2020) | 2016: proliferation, FIC freeze and inspection powers, structuring offence, administrative sanctions. 2020: new ss.5, 16, 19, 23, 24, 26 and 27, duty to refrain from suspected transactions, s.49C sanctions | In force |
| SI No. 53 of 2022 (Prescribed Threshold Regulations) | CTR threshold, wire-transfer and virtual-asset transfer thresholds, cross-border declarations | Signed 29 July 2022, published 19 August 2022; replaced SI 52 of 2016 |
| SI No. 54 of 2022 (General Regulations) | Freezing, customer due diligence, accountable institutions, risk management, STR forms, registration | Same dates |
| PPMLA, 2001 (Act No. 14 of 2001, amended by Act No. 44 of 2010) | The money-laundering offence, seizure and forfeiture | In force; no later amendment found |
| BoZ AML/CFTP Directives, 2017 | Reporting duties for every entity BoZ licenses or designates | Effective 30 June 2017; no newer BoZ AML directive as of 1 October 2026 |
| BoZ CB Circular No. 05/2026; BoZ Directives on Virtual Assets, 2026 | Checks on virtual-asset partners and customers; licensing and AML duties for VASPs | In force since 10 March and 18 September 2026 |
"Financial service provider" takes its meaning from the Banking and Financial Services Act, 2017, so a bank is a reporting entity under the FIC Act.
The Bank of Zambia AML/CFTP Directives, 2017
The Directives were made under section 36(4) of the FIC Act "in consultation with the Centre" and, by Directive 3, "apply to all reporting entities licensed or designated by the Bank of Zambia". CB Circular No. 04/2017 of 26 June 2017 made them effective on 30 June 2017, and Directive 17 repealed the 2004 Directives. No Gazette notice number appears on BoZ's copy.
What they require, using the numbering in the body of the document:
- STRs (Directive 5). Report to the Centre "within three (3) working days of forming that suspicion", with the grounds and particulars; attempted transactions included.
- The compliance officer's register (Directive 6). The officer keeps "a register of all reports made by employees of the reporting entity and of all reports that the officer makes to the Centre". If the officer resigns or is dismissed, the bank sends a written statement of the reasons to BoZ and the FIC within ten days.
- Board programmes and the annual report (Directive 9). The board ensures internal programmes to prevent, detect and report suspicious activity, and submits an annual compliance report to BoZ giving the number of internal reports submitted to the Centre.
- Confidentiality, immunity and TF/PF (Directives 10, 13 and 14). No disclosure of the contents of an STR; no civil, criminal, administrative or disciplinary liability for good-faith reporting; procedures to detect and deter terrorist or proliferation financing.
Unlike the 2004 text, the 2017 Directives contain no customer due diligence or record-keeping rules; those sit in the FIC Act and SI No. 54 of 2022.
Penalties. Directive 15 makes any contravention an offence: up to 700,000 penalty units, seven years, or both. Directive 16 lets BoZ sanction a failure to submit an STR with suspension of the licence or of an officer for up to six months, removal from office, or a fine of up to 700,000 penalty units. The arrangement list numbers these 14 and 15 while the body numbers them 15 and 16; we cite the body.
Still current. BoZ's listing holds no newer AML directive, and the NRA 2025 and BoZ's September 2026 virtual-asset directives both still cite the 2017 text. The Bank of Zambia Anti-Money Laundering Directives, 2004, made under the PPMLA, are history: the document says it was issued on 19 August 2004, BoZ's listing dates it 1 June 2004, and the 2017 Directives repealed it.
A bank's core duties under the FIC Act
Customer due diligence (section 16). CDD applies at onboarding, on occasional transactions and wire transfers at or above the prescribed amounts, when earlier data is in doubt, and on suspicion. Where it cannot be completed, the bank "shall not open the account, commence business relations or perform the transaction" and must file an STR (section 16(9)); where CDD itself would tip off the customer, it files an STR instead (section 16(10)). Walk-in customers transacting up to USD 1,000 may be identified by passport, driver's licence, national ID or refugee card (SI No. 53 of 2022, regulation 5).
Risk assessment (section 19). A documented assessment covering products, services, delivery channels, customers and geography, new products and technologies assessed before launch, and for high-risk customers senior-management approval, source-of-wealth and source-of-funds checks and increased monitoring.
The compliance programme (section 23). Thirteen elements, ending with "(l) transaction monitoring systems; and (m) adequate screening procedures for customers against relevant sanctions lists." Agents must be included and monitored (section 23(8)).
The compliance officer (section 23(3) and (4)). At senior management level, with two years' regulatory-compliance experience, no disqualifying conviction, and "certified and approved by the Centre". The FIC's vetting form is submitted "before an Officer is appointed as a Compliance Officer", and a separate form approves the Reporting Officers who support that officer. In 2024 the FIC approved 112 compliance officers and 28 MLROs.
Ongoing due diligence and wire transfers (sections 24 and 26). Ongoing due diligence includes "scrutinising transactions undertaken throughout the course of that relationship". Wire transfers of USD 1,000 or more carry full originator and beneficiary information (SI No. 53 of 2022, regulation 6), and section 26(15) provides: "The Bank of Zambia shall provide wire transfer records to the Centre."
Records (section 22). Customer and transaction records and STR copies are "maintained for not less than ten years".
Reporting duties: what goes to the FIC and what goes to BoZ
| Report | Basis | Deadline | Channel | Guide |
|---|---|---|---|---|
| Suspicious transaction report | FIC Act s.29; BoZ Directive 5 | Three working days after forming the suspicion; attempts included | Form IV of SI 54 "Via the Online Portal"; email or post only in exceptional circumstances | STR guide |
| Currency transaction report | FIC Act s.30; SI 53 reg. 7 | Cash at or above the Kwacha equivalent of USD 10,000, single or linked; three working days after the transaction | Schedule form "via the Online Portal"; email or post only in exceptional circumstances | CTR guide |
| Weekly over-the-counter cash return | BoZ CB Circular No. 13/2025 (4 April 2025) | The Wednesday after each reporting period | To BoZ; not an FIC report | None |
| Foreign cash export and import notice | BoZ CB Circular No. 11/2026 (5 August 2026) | In writing, before the export or import | To BoZ; not an FIC report | None |
| De-risking notification | FIC directive of 27 December 2023 under s.56(1) | When a client or service is de-risked; no deadline quoted | To the FIC, with identities, dates and reasons | None |
| Wire-transfer records | FIC Act s.26(15) | Supplied by BoZ to the FIC | BoZ to the FIC | None |
| Cross-border currency declaration | SI 53 reg. 8, above USD 5,000 | Reaches the FIC from the Zambia Revenue Authority (2,888 in 2024) | ZRA to the FIC | None |
The FIC's STR Guidance Note routes every STR through the designated compliance officer and warns that giving the board details of individual STRs risks tipping off; only aggregate numbers go to the board. The two cash returns to BoZ do not discharge the FIC's CTR. No rule defines a time window for linking transactions or names the exchange rate for the Kwacha equivalent.
Electronic filing runs through the FIC's goAML portal, goaml.fic.gov.zm, which is "for electronic submission of various reports to the FIC". A bank registers as an organisation before it can log in; see our goAML registration guide and our goAML reporting readiness guide for banks. No provision of the Act or the regulations names goAML, and we found no FIC or BoZ rule setting a date by which a bank must report through it. In 2024 commercial banks filed 8,710 of the FIC's 8,981 STRs, or 96.9%, and the FIC received 377,808 CTRs.
Virtual-asset customers and partners
BoZ's CB Circular No. 05/2026 of 10 March 2026 required every virtual-asset and stablecoin service provider operating in Zambia to register with the Bank by 27 March 2026. It directed all regulated entities to conduct due diligence before partnering with such providers and to "verify that such service providers are registered with the Bank", to apply similar due diligence at account opening to customers who appear to provide virtual-asset services, and to report virtual-asset payment data, on pain of sanctions under the Banking and Financial Services Act No. 7 of 2017 and the National Payment Systems Act No. 1 of 2007.
The Bank of Zambia Directives on Virtual Assets, 2026 (Gazette Notice No. 1439 of 2026, 18 September 2026) took effect on publication, give existing providers twelve months to apply for a licence, and require a VASP to comply with the PPMLA and the FIC Act, designate a senior reporting officer, carry out CDD before providing the service and report STR statistics to BoZ monthly. The Directives bind the providers; a bank's duties towards them come from the March circular. VASPs also register with the FIC itself under its December 2022 guidelines; it counted three in 2024.
The FIC's powers over a bank
Where the Director-General reasonably suspects a transaction relates to money laundering, terrorist or proliferation financing or another serious offence, the Director-General "may order a reporting entity to freeze an account or suspend a transaction" for up to fifteen days (section 10(3)); the bank stops all activity on the account "with the exception of credits received into that account" (SI No. 54 of 2022, regulation 6(3)). In 2024 the FIC froze 34 bank accounts and 10 mobile-money accounts, with cumulative balances of USD 4.7 million and ZMW 176.9 million.
The 2016 amendment added an inspectorate (section 11A), court monitoring orders that lapse after ninety days (section 37A), notices to comply (section 37B), compliance orders with a further fine of up to 2,000 penalty units a day (section 37C), an obstruction offence (section 49A) and the power to issue "instructions, directives, guidelines or rules" (section 56). The FIC used section 56(1) on 27 December 2023 to direct commercial banks to notify it whenever they de-risk clients or services. The Director-General may also compound an admitted offence, with the Director of Public Prosecutions' written consent, for up to fifty percent of the maximum fine (section 49B).
Penalties and sanctions
| Breach | Provision | Maximum |
|---|---|---|
| Identification failures, anonymous accounts, wire-transfer breaches | FIC Act s.42 | 1,000,000 penalty units, ten years, or both |
| Record-keeping failures | s.43 | 200,000 penalty units, two years, or both |
| Due diligence, special monitoring and internal-control failures | s.44 | 500,000 penalty units, five years, or both |
| Failing to submit any report required under the Act; structuring | ss.45, 45A | 700,000 penalty units, seven years, or both |
| False or misleading reporting; tipping off; unlawful disclosure | ss.46, 33, 47 | 500,000 penalty units, five years, or both |
| Administrative sanctions by the FIC or BoZ, after 14 days' written notice | s.49C | Caution to 1,000,000 penalty units; appeal to the High Court within 30 days |
| Any contravention of the BoZ 2017 Directives | Directive 15 | 700,000 penalty units, seven years, or both |
| BoZ sanctions for failing to file an STR | Directive 16 | Licence or officer suspension up to six months, removal from office, or 700,000 penalty units |
| Money laundering | PPMLA ss.7, 8, 24 | 170,000 penalty units, ten years, or both; 400,000 penalty units for a body corporate; a repeat offender at least five years or twice the fine |
Directors and managers are liable for a company's offence under the FIC Act "as if the director or manager had personally committed the offence", unless they prove lack of knowledge or reasonable steps to prevent it (section 52). A Ministry of Mines and Minerals Development notice records that the penalty unit rose from thirty to forty ngwee from 26 April 2024; at K0.40 per penalty unit (SI No. 25 of 2024), 700,000 penalty units is K280,000 and one million is K400,000. We did not retrieve the SI itself.
What examiners found in 2024 and the risk picture
The FIC inspected 55 reporting entities in 2024, up from 28, and listed incomplete customer due diligence, "non-reporting of STRs and CTRs", no sanctions screening of customers, inadequate risk assessments and a lack of independent AML audits as the main deficiencies; it imposed monetary penalties of ZMW 1.2 million. BoZ, with the FIC, examined three commercial banks and found "inadequacies in board and senior management oversight of money laundering and financing of terrorism risks".
The NRA 2025, launched on 19 March 2026, rates national money-laundering risk medium, down from medium-high in 2016, and the banking sector medium. Zambia was not on the FATF's increased-monitoring or call-for-action lists after the June 2026 plenary. The NRA says the third round of mutual evaluation is "commencing in December 2027", and the FIC's Trends Report 2025 adds: "The Mutual Evaluation (ME) for Zambia is due in 2027 and the FIC is coordinating this important national exercise."
Frequently asked questions
Which AML directives apply to banks in Zambia?
The Bank of Zambia Anti-Money Laundering and Combating the Financing of Terrorism or Proliferation Directives, 2017, effective 30 June 2017, for every reporting entity BoZ licenses or designates. They repealed the 2004 Directives. As of 1 October 2026 no newer BoZ AML directive exists.
Does the FIC Act require a transaction monitoring system?
Yes. Section 23 lists "transaction monitoring systems" and sanctions-list screening of customers among the thirteen elements of the compliance programme, and section 24 requires ongoing due diligence that includes scrutinising transactions throughout the relationship.
What must a bank report to BoZ rather than to the FIC?
Weekly over-the-counter cash returns (CB Circular No. 13/2025), advance notice of foreign-cash exports and imports (CB Circular No. 11/2026), the ten-day statement when a compliance officer resigns or is dismissed (also sent to the FIC), and the board's annual compliance report (Directive 9). STRs and CTRs go to the FIC.
What is the STR deadline for banks?
Not later than three working days after forming the suspicion, under section 29 of the FIC Act and Directive 5 of the BoZ 2017 Directives. Attempted transactions count, and since 2020 the bank must refrain from carrying out a transaction it suspects.
How are penalty units valued?
By statutory instrument. A Ministry of Mines and Minerals Development notice records that SI No. 25 of 2024 raised the penalty unit from thirty to forty ngwee from 26 April 2024. At K0.40 per penalty unit (SI No. 25 of 2024), the 700,000-unit maximum for a missed report is K280,000.
Where Creodata fits
Creodata's AML compliance software in Zambia maps these duties to modules: sanctions and PEP screening against versioned lists for section 23(m), transaction monitoring with a rule engine and cash-threshold rules for sections 23(l) and 24 and the USD 10,000 CTR line, customer risk rating for section 19, and case management with a draft, review, approve and submit lifecycle for the compliance officer's decisions. The goAML reporting module for Zambia produces schema-valid goAML XML, validated against the XSD and business rules before it is uploaded to the FIC's portal, with a manual download if the portal is down. An append-only audit log and evidence packs support BoZ and FIC inspections. See our buyer's guide to AML compliance software in Zambia or book a demo.
Sources and date checked
- Financial Intelligence Centre Act, 2010 (Act No. 46 of 2010), parliament.gov.zm copy; 1 October 2026.
- Financial Intelligence Centre (Amendment) Acts No. 4 of 2016 (scanned FIC copy) and No. 16 of 2020 (mofnp.gov.zm copy); 1 October 2026.
- SI No. 53 of 2022 (gazette copy on media.zambialii.org) and SI No. 54 of 2022 (scanned FIC copy); 1 October 2026.
- Prohibition and Prevention of Money Laundering Act, 2001, as amended by Act No. 44 of 2010, Laws.Africa consolidation on media.zambialii.org; 1 October 2026.
- Bank of Zambia AML/CFTP Directives, 2017, CB Circular No. 04/2017, the Anti-Money Laundering Directives, 2004, CB Circulars No. 13/2025, No. 05/2026 and No. 11/2026, the Directives on Virtual Assets, 2026 (Gazette Notice No. 1439 of 2026), the Financial System Supervision Report 2024 and BoZ's regulatory-framework listing, boz.zm; 1 October 2026.
- FIC Directive to Commercial Banks on De-risking of Clients (27 December 2023); Approval Criteria for Compliance Officers (2020) and for a Reporting Officer (2023); Guidance Note on Reporting of Suspicious Transactions (March 2022); VASP Sector Guidelines (December 2022); Trends Report 2024 (July 2025); National Risk Assessment Report 2025 (launched 19 March 2026); 1 October 2026.
- FIC, Money Laundering and Terrorism Financing Trends Report 2025; 4 November 2026.
- FATF increased-monitoring and call-for-action lists, June 2026 plenary; 17 September 2026.
- Ministry of Mines and Minerals Development notice on SI No. 25 of 2024 (penalty unit value); 1 October 2026.
- FIC Zambia goAML production portal, goaml.fic.gov.zm, public home page; 1 October 2026.
More guides for Zambia
- Zambia FIC goAML Compliance: A Practical Guide for Banks
- FIC goAML Registration in Zambia: Who Registers, the Portal Steps and What to Prepare (2026)
- Suspicious Transaction Reports in Zambia: The FIC's Three-Working-Day Rule, Filing and Tipping-Off (2026)
- Currency Transaction Reports in Zambia: The USD 10,000 Threshold, the Three-Working-Day Deadline and Filing (2026)
- Filing Currency Transaction Reports on goAML in Zambia: From the FIC's Online Portal Forms to Bulk XML (2026)
- Zambia's Financial Intelligence Centre Act, 2010 Explained: The FIC Act, the PPMLA and the Bank of Zambia's AML Directives
- AML Compliance Software in Zambia: A Buyer's Guide for Banks, Microfinance and Fintechs (2026)
- goAML Reporting for Zambian Banks: Registration, STRs, CTRs and Readiness Before the 2027 Mutual Evaluation (2026)
