goAML Reporting for Zambian Banks: Registration, STRs, CTRs and Readiness Before the 2027 Mutual Evaluation (2026)

Short answer: Zambian commercial banks are reporting entities under the Financial Intelligence Centre Act, 2010. They file suspicious transaction reports (STRs) with the Financial Intelligence Centre (FIC) within three working days of forming the suspicion, and currency transaction reports (CTRs) within three working days of a currency transaction at or above the kwacha equivalent of USD 10,000. The prescribed forms say to send both "Via the Online Portal", and the FIC's portal is its goAML system at goaml.fic.gov.zm, which a bank must register on before it can log in. No law or directive we found requires a bank to use goAML by any date. The fixed date is the mutual evaluation: the National Risk Assessment 2025 says it starts in December 2027, and the FIC's Trends Report 2025 says it "is due in 2027".

This guide is for compliance officers, money laundering reporting officers (MLROs), heads of operations and IT at Zambian commercial banks and other reporting entities licensed by the Bank of Zambia (BoZ). It uses only what the FIC, BoZ and the goAML portal's public pages say, and states where we found nothing. It is a practical guide, not legal advice.

---

Why 2027 is the date on the wall

Two FIC-published documents date the next review of Zambia's AML regime. The National Risk Assessment 2025 says: "Zambia will be undergoing the third round of Mutual Evaluation of its AML/CFT/CPF regime commencing in December 2027." The FIC's Trends Report 2025 says: "The Mutual Evaluation (ME) for Zambia is due in 2027 and the FIC is coordinating this important national exercise." Neither sets a goAML deadline, and we found no rule, circular or directive that requires banks to report through goAML, or to be goAML-compliant, by 2027 or any other date.

Reporting is already under scrutiny. The FIC's Trends Report 2024 says on-site inspections covered 55 reporting entities in 2024, up from 28, and found "non-reporting of STRs and CTRs" among the main deficiencies; the FIC imposed monetary penalties of ZMW 1.2 million on non-compliant entities.

BoZ's Financial System Supervision Report 2024 adds the banking view. With the FIC, BoZ examined three commercial banks in 2024 and found "inadequacies in board and senior management oversight of money laundering and financing of terrorism risks". Examinations of eight bureaux de change found "deficiencies in customer due diligence processes, suspicious transaction reporting processes and sanctions screening procedures at branches".

---

What the FIC receives today

Banks carry Zambia's reporting. The FIC received 8,981 STRs in 2024 (10,293 in 2023; 5,745 in 2022). Commercial banks filed 8,710 of them, 96.9% of the total; MVTS providers filed 184 and virtual asset service providers 35. The commonest reasons were "Large or unusual cash deposit" (1,217) and "Large or unusual outward remittance" (1,105); 668 cited "Avoiding reporting obligations".

CTRs are a far larger stream: 377,808 in 2024, a 32.6% rise on 285,004 in 2023, worth ZMW 1,036.4 billion; 259,762 were corporate and 118,046 individual.

The National Risk Assessment 2025 counts 30,620 STRs and 1,327,832 CTRs from 2019 to 2024, and found that "the suspicious transaction and currency transaction reporting system was automated and the majority of reports from reporting entities were received electronically".

In 2024 the FIC analysed 18,330 reports and disseminated 951 intelligence reports, 573 of them to the Zambia Revenue Authority. The Act requires the FIC to keep every STR "for a minimum of fifteen years after the information is received" (section 57) and, "as far as is practicable", to tell the reporting entity what action it took (section 54(2)).

---

goAML in Zambia

The FIC began implementing the UNODC's goAML system in 2023. Its bulletin for the first quarter of 2024 said: "We envisage to go-live in quarter 3 of 2025." We found no announcement of the actual go-live date, and the Trends Report 2025 does not mention goAML or the portal.

The production portal is at goaml.fic.gov.zm. Its home page says: "The goAML system is for electronic submission of various reports to the FIC and engagement with Competent Authorities." You must log in to submit. Support is on (+260) 211 220 254 or gosprt@fic.gov.zm; the help text reads "Kindly contact the FIC for any assistance with the system."

The FIC also runs a site labelled "TEST ENVIRONMENT" on the same goAML version. We found no FIC statement on whether a bank must test there first.

The production settings, read on 1 October 2026: goAML XML schema version "5.0", up to 500 transactions per report, up to 10 attachments of up to 10,000,000 bytes each. The report-type codes need a login. We found no FIC goAML user guide, registration manual or registration notice anywhere.

---

Before a bank can file

An FIC-approved compliance officer. Section 23 of the Act, as substituted in 2020, requires a compliance officer at senior management level with two years' regulatory-compliance experience who is "certified and approved by the Centre". The FIC's approval form must be submitted "before an Officer is appointed as a Compliance Officer"; a second form covers MLROs. In 2024 the FIC approved 112 compliance officers and 28 MLROs.

Portal access follows approval. The FIC's Banking Sector Reporting Guidelines (2019) say "the designated compliance officer should obtain login credentials from the FIC for the FIC online reporting portal", and that other officers go to the FIC "for vetting, approval and subsequent configuration to the online reporting portal". Those guidelines predate goAML. We found nothing that says the goAML Administrator must be the approved compliance officer, so plan on the same order and confirm it with the FIC.

Registration. The bank registers once under "Register an Organisation" as a "Reporting Entity": organisation details (business type, name, acronym, email and SWIFT/BIC are mandatory), an "Administrator" and one to five attachments. The portal issues a reference number and the FIC accepts or rejects by email. Other staff then register as "User (Reporting Entity)" with the bank's Organization ID. The steps are in our FIC goAML registration guide.

---

The reports a bank files

Three STR duties sit outside the form. The FIC's STR Guidance Note (2022) routes every STR through the designated compliance officer and warns that "Only aggregated statistical information on the number of STRs submitted to the FIC might be reported to the Board". The BoZ AML/CFT Directives 2017 add a register of all internal reports and all reports to the FIC, a statement of reasons to BoZ and the FIC within ten days if the compliance officer resigns, and an annual board compliance report to BoZ giving the number of internal reports submitted to the FIC.

Three CTR questions stay open. The amount "is a threshold and not a limit", the FIC's 2023 guidelines say, but no rule defines a linking window or the exchange rate for the kwacha equivalent. Since 2020 the Act defines "currency" to include electronic or virtual form, while the FIC's guidelines and the prescribed form describe CTRs as cash transactions. Splitting transactions to avoid a report is structuring (section 45A).

Our STR guide and CTR guide cover each report in full; the Financial Intelligence Centre Act explained covers the law behind them.

---

The data a goAML report needs and where it hides

The prescribed CTR form asks for the person the transaction was for; the individual conducting it "IF OTHER THAN ABOVE"; "Total cash in (K)" and "Total cash out (K)"; "Foreign Currency Amount and Type"; "Account Number(s) Affected"; "Transaction Type"; and boxes for "Amends Prior Report", "Multiple Persons" and "Multiple Transactions". The STR form asks for "the factors or unusual circumstances that led to the suspicion", "whether the transaction is an isolated incident or involves other transactions", the other persons involved, and at least one ticked reason for suspicion.

In practice those fields rarely come from one system:

• Scale. A large bank can have thousands of reportable cash transactions a week; a smaller institution often keys each report into web forms by hand.
• Third-party deposits. The depositor's name and ID number often sit in a free-text narration on the teller posting, not in a party record.
• Counterparties. The other parties an STR narrative must name are often only in payment messages.
• Linked transactions. No rule defines the window, so the bank sets one and applies it consistently across branches and days.
• Rejections after upload. Files built from older templates fail on deprecated or unmapped elements, and each rejection restarts work inside a three-working-day clock.
• Ageing. Turnaround from alert to filed report is tracked in spreadsheets, so showing it at an inspection takes work.

The goAML reporting module of the Creodata AML platform is built for that gap: it generates schema-valid goAML XML from transaction and customer data and validates it against the goAML XSD and business rules before it is uploaded to the FIC's portal.

---

Penalties and sanctions

At K0.40 per penalty unit (SI No. 25 of 2024), 700,000 penalty units is K280,000 and one million penalty units is K400,000; we took the unit value from a ministry notice and did not read the SI itself.

---

Readiness checklist

1. Compliance officer approved by the FIC before appointment; MLROs approved on the reporting-officer form.
2. Bank registered on goaml.fic.gov.zm as a "Reporting Entity"; reference number and acceptance email kept.
3. BoZ and the FIC told within ten days, with reasons, if the compliance officer resigns; portal users updated.
4. FIC asked whether to test on its "TEST ENVIRONMENT" before live filing.
5. XML built to schema version "5.0" and validated before upload.
6. Reports kept within 500 transactions and 10 attachments of up to 10,000,000 bytes.
7. A documented linking rule and exchange-rate basis for the USD 10,000 equivalent, since no rule sets either.
8. STR clock: three working days from forming the suspicion, attempted transactions included, the suspected transaction not carried out.
9. CTR clock: three working days from the transaction, with subsequent CTRs on customers already reported.
10. A register of all internal reports and all reports to the FIC, with only aggregate counts going to the board.
11. Customer and transaction records and STR copies kept for at least ten years.
12. Annual board compliance report to BoZ with the number of internal reports submitted to the FIC.
13. Evidence for inspection: for every report, who filed it, when, and any amendment.

---

Frequently asked questions

Is there a law that requires Zambian banks to use goAML?

We found no provision that names goAML. The Act requires the FIC to keep a register of reporting entities (section 36A), and the prescribed STR and CTR forms say to send reports via the online portal, which is the FIC's goAML system. No rule we found sets a date.

What is the STR deadline in Zambia?

Section 29 of the FIC Act: "not later than three working days after forming the suspicion". The duty covers attempted transactions, and since 2020 the entity must refrain from carrying out a transaction it suspects.

What is the CTR threshold?

A currency transaction "equal to or above the kwacha equivalent of ten thousand United States dollars", in kwacha or a foreign currency, reported within three working days (FIC Act s.30; SI No. 53 of 2022 reg. 7). No rule sets the exchange rate or a linking window.

Does the FIC publish a goAML user guide?

Not that we could find. We found no FIC goAML user guide, registration manual or registration notice on the FIC's website or the portal, and the help text says to contact the FIC on (+260) 211 220 254 or gosprt@fic.gov.zm.

When is Zambia's next mutual evaluation?

The National Risk Assessment 2025 says the third round commences in December 2027. The FIC's Trends Report 2025 says it "is due in 2027" and that the FIC is coordinating it. Neither document mentions goAML.

---

goAML reporting for Zambian banks with Creodata

The goAML reporting module of the Creodata AML platform generates schema-valid goAML XML from transaction and customer data and validates it against the goAML XSD and business rules before it is uploaded to the FIC's portal. Currency-threshold rules bring linked transactions together, an STR drafting workspace holds parties, accounts and narrative in one place, and an immutable audit trail records every report and filing, with a manual download if the portal is down. Registration and the upload remain the bank's own steps. Projects run six to eight weeks from kickoff to first live submission. See the goAML reporting module for Zambia and AML compliance software in Zambia, or start with our buyer's guide.

---

Sources and date checked

• Financial Intelligence Centre Act, 2010 (Act No. 46 of 2010); FIC (Amendment) Act No. 4 of 2016; FIC (Amendment) Act No. 16 of 2020. Checked 1 October 2026.
• SI No. 53 of 2022 (Prescribed Threshold Regulations) and its CTR form; SI No. 54 of 2022 (General Regulations) and Form IV; SI No. 25 of 2024 (penalty unit value), as described in a Ministry of Mines and Minerals Development notice, the SI text not read. Checked 1 October 2026.
• FIC: Banking Sector Reporting Guidelines 2019; NBFI Sector Guidelines, August 2023; Guidance Note on Reporting of Suspicious Transactions, March 2022; compliance officer and reporting officer approval forms; Directive to Commercial Banks on De-risking of Clients, 27 December 2023; FIC Bulletin, Quarter 1 2024; Trends Report 2024. Checked 1 October 2026.
• FIC, Money Laundering and Terrorism Financing Trends Report 2025. Checked 4 November 2026.
• Republic of Zambia, National Risk Assessment Report 2025. Checked 1 October 2026.
• Bank of Zambia: AML and Combating the Financing of Terrorism or Proliferation Directives, 2017; CB Circulars No. 13/2025 and No. 11/2026; Financial System Supervision Report 2024. Checked 1 October 2026.
• FIC Zambia goAML production and test portals, public pages and settings, host goaml.fic.gov.zm. Read 1 October 2026.