goAML Zambia: FIC Portal, STR Deadline & CTR Threshold

Short answer: Reporting entities file with the Financial Intelligence Centre (FIC), whose goAML portal is at goaml.fic.gov.zm. Suspicious transaction reports are due not later than three working days after forming the suspicion, and currency transactions equal to or above the Kwacha equivalent of USD 10,000, single or linked, within three working days. Reports are keyed into the portal or uploaded as XML that must validate against the goAML schema. For software that generates and validates those files, see goAML reporting software for Zambia.

Zambia's AML/CFT compliance environment has undergone significant transformation over the past several years. Following the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG) mutual evaluation of Zambia and the associated country report, Zambia's government, Financial Intelligence Centre (FIC), and Bank of Zambia (BoZ) have collectively intensified their focus on the quality, timeliness, and completeness of financial intelligence submitted through the goAML portal.

For compliance officers at Zambian commercial banks, development finance institutions, mobile money operators, and other designated non-financial businesses and professions (DNFBPs), the message from regulators is clear: goAML reporting is a priority enforcement area, and the standard for what constitutes an acceptable submission has risen considerably.

This guide provides a practical, operational reference for Zambian reporting entities. It covers the legal framework, the goAML portal, CTR and STR requirements specific to Zambia, XML validation rules, and how to deploy an AML reporting platform that serves Zambia's unique requirements — without requiring a separate software solution for every country in your operating footprint.

For regional context, see our companion guides: Kenya FRC goAML Reporting: Complete Guide 2026 and ESAAMLG Mutual Evaluations: What Every East African Bank Must Know.

Zambia's AML Legal Framework

Financial Intelligence Centre Act, 2010 (Act No. 46 of 2010)

The Financial Intelligence Centre of Zambia (FIC) operates under the Financial Intelligence Centre Act, 2010 (Act No. 46 of 2010), as amended by the Financial Intelligence Centre (Amendment) Acts No. 4 of 2016 and No. 16 of 2020. The Act establishes the FIC as Zambia's financial intelligence unit (FIU), confers on it the powers to receive and analyse financial intelligence, and creates the legal obligation for reporting entities to submit Suspicious Transaction Reports (STRs) and Currency Transaction Reports (CTRs) — the Zambian equivalent of Kenya's Cash Transaction Reports.

The FIC Act defines the categories of "reporting entities" subject to reporting obligations — banks and other financial institutions, insurers, securities firms, casinos, lawyers, accountants and estate agents among them — and grants the FIC powers to inspect, investigate, and sanction institutions that fail to meet their obligations. Since the 2020 amendment the Act also recognises a separate, narrower class of "accountable institutions": motor vehicle dealers, property developers, safe-custody providers, co-operative societies and travel agents, which carry customer due diligence, currency transaction reporting and record-keeping duties. The Act has been supplemented by regulations — principally the Financial Intelligence Centre (Prescribed Threshold) Regulations, 2022 (Statutory Instrument No. 53 of 2022) and the Financial Intelligence Centre (General) Regulations, 2022 (Statutory Instrument No. 54 of 2022) — and by FIC guidelines that provide operational detail on reporting formats, thresholds, and timelines.

Amendments to the FIC Act have progressively strengthened the Centre's powers, including the introduction of administrative penalty provisions and expanded information-sharing authority with the Financial Intelligence Units of partner countries. The FIC is a member of the EGMONT Group of Financial Intelligence Units, enabling it to exchange financial intelligence internationally.

Prohibition and Prevention of Money Laundering Act, 2001

Money laundering is criminalised by the Prohibition and Prevention of Money Laundering Act, 2001 (Act No. 14 of 2001, amended by Act No. 44 of 2010). The Act also establishes the Anti-Money Laundering Authority and the Anti-Money Laundering Investigations Unit — the investigative framework that gives effect to the intelligence gathered by the FIC — and it defines the money laundering offences and the penalties that apply to them.

For reporting institutions, the Prohibition and Prevention of Money Laundering Act is relevant primarily because it defines the underlying offences that STRs are meant to detect and report. When a compliance officer forms a suspicion that a transaction may be connected to money laundering, it is that Act's definition of the offence — and its broad scope covering layering, integration, and any dealing in proceeds of crime — that informs the threshold for filing.

FATF and ESAAMLG Alignment — Zambia's Mutual Evaluation Results and Action Plan

Zambia underwent its ESAAMLG mutual evaluation under the FATF 2012 Methodology, and the resulting report identified a number of technical compliance and effectiveness deficiencies across the AML/CFT framework. Key findings relevant to reporting institutions included:

Technical compliance weaknesses in the implementation of FATF Recommendations 20 (suspicious transaction reporting) and 23 (designated non-financial businesses and professions), with certain reporting entity categories not fully integrated into the FIC reporting regime
Effectiveness deficiencies in the quality and actionability of STR submissions — assessors found that a significant proportion of STRs received by the FIC lacked adequate narrative, contained incomplete customer identification, or were filed so late as to limit their investigative value
Supervision gaps in certain DNFBP categories, where AML/CFT oversight was less developed than for the banking sector

Zambia developed a post-mutual-evaluation action plan to address these deficiencies. The action plan includes specific commitments on improving STR quality, increasing the proportion of STRs that lead to actionable intelligence disseminations, and strengthening FIC's supervision of DNFBPs. Zambian reporting institutions should be aware that the FIC is operating under international scrutiny to demonstrate measurable improvement in these areas — which translates directly into tighter enforcement of reporting quality standards.

FIC Zambia and the goAML Portal

How FIC Uses the UNODC goAML System

Like Kenya's FRC, the FIC Zambia has adopted the UNODC goAML system as its primary platform for receiving financial intelligence from reporting institutions. The goAML portal accepts Suspicious Transaction Reports, Currency Transaction Reports, and other report types in XML format conforming to the goAML XSD v5.0.2 schema.

FIC analysts use the goAML analytics environment to run link analysis between reports, identify common subjects across multiple STRs, detect currency transaction patterns, and generate financial intelligence reports (FIRs) for dissemination to law enforcement. The quality of the intelligence available for analysis is entirely dependent on the quality of the reports submitted — which is why the FIC has increasingly focused on submission completeness and narrative quality.

The FIC uses goAML data to feed Zambia's national money laundering and terrorism financing risk assessment, which is reviewed periodically and informs both supervisory priorities and the country's international reporting obligations to ESAAMLG and FATF.

Reporting Entities Required to Register with FIC

All "reporting entities" under the FIC Act must register with the FIC and submit reports through the goAML portal. These include:

Commercial banks, building societies, and finance companies regulated by the Bank of Zambia
Microfinance institutions
Mobile money operators and payment system providers
Insurance companies and brokers regulated by the Pensions and Insurance Authority (PIA)
Securities dealers and collective investment scheme managers regulated by the Securities and Exchange Commission of Zambia (SEC)
Casinos and gaming operators
Real estate agents (when acting in a transaction capacity)
Dealers in precious metals and stones
Accountants and auditors in public practice
Lawyers when handling client funds or real property transactions
Money changing businesses (forex bureaus)

Co-operative societies, property developers, motor vehicle dealers, safe-custody providers and travel agents fall into the separate "accountable institutions" class created by the 2020 amendment. They carry customer due diligence, currency transaction reporting and record-keeping duties, at the same USD 10,000-equivalent threshold described below.

Institutions that have not registered with the FIC cannot submit reports through the goAML portal and are in breach of the FIC Act. Registration includes providing details of the institution's Compliance Officer (or Money Laundering Reporting Officer), which must be kept current.

Differences from Kenya FRC in Practice

While both Kenya's FRC and FIC Zambia use the same underlying goAML platform, there are meaningful operational differences in how the two FIUs have configured and operate their goAML instances.

The FIC Zambia portal interface differs from the FRC Kenya interface in several respects: field labelling conventions, help text, and the specific dropdown option lists for transaction types and indicator codes are configured differently to reflect Zambia's typologies and legal framework. Zambian institution codes and branch codes use FIC-assigned identifiers rather than the CBK codes used in Kenya.

FIC Zambia's XML validation rules also differ from Kenya's FRC in field-level requirements. Zambia's implementation places greater emphasis on occupation data for individual subjects, beneficial ownership information for legal entities, and the National Registration Card (NRC) as the primary individual identity document — rather than Kenya's National ID. Compliance teams operating across both Kenya and Zambia must ensure that their XML generation logic applies the correct country-specific rules.

Error handling and portal feedback also differs. The FRC Kenya portal provides relatively detailed rejection messages, while FIC Zambia's portal has historically provided more generic validation error codes. Compliance teams new to Zambia FIC reporting often find this more challenging when troubleshooting rejected submissions.

CTR Threshold in Zambia

Current Threshold: the Kwacha Equivalent of USD 10,000

Zambia's Currency Transaction Report threshold is the Kwacha equivalent of USD 10,000. Under section 30 of the FIC Act and regulation 7 of the Financial Intelligence Centre (Prescribed Threshold) Regulations, 2022 (Statutory Instrument No. 53 of 2022), a reporting entity must report any currency transaction "equal to or above the kwacha equivalent of ten thousand United States dollars", whether it is carried out in Kwacha or in foreign currency, and whether it is a single transaction or several transactions that appear to be linked. The report is due "promptly but not later than three working days".

Because the threshold is expressed in US dollars, its Kwacha value moves with the exchange rate, so detection rules need a current rate rather than a fixed Kwacha figure. The threshold is set by statutory instrument, not by FIC circular: SI 53 of 2022 revoked the 2016 threshold regulations (SI 52 of 2016), and any future change would come the same way. The same USD 10,000 line applies to accountable institutions.

As with Kenya's regime, the threshold applies to physical currency transactions — cash deposits, cash withdrawals, cash foreign exchange, and cash remittance payments. Electronic transfers, cheque deposits, and card transactions are not counted toward the CTR threshold, though they remain subject to STR obligations if suspicious.

Multi-Currency and USD Equivalent Reporting

Zambia has a significant US dollar economy — particularly in the mining, agriculture export, and cross-border trade sectors. USD cash transactions are common, and because the threshold itself is set in US dollars, every cash transaction has to be tested against the Kwacha equivalent of USD 10,000 at the day's prevailing rate: a US dollar transaction compares with USD 10,000 directly, while Kwacha and other-currency transactions are converted.

The FIC Zambia goAML implementation requires that CTR submissions for foreign currency transactions include both the original foreign currency amount and the ZMW equivalent, along with the exchange rate applied. Institutions should use their official buying rate (or the Bank of Zambia indicative rate, where internal rates are not maintained) and document the rate used. Inconsistent exchange rate methodology across submissions is a data quality deficiency that the FIC has flagged during inspections.

Where linked transactions are in different currencies — a customer making a USD cash deposit and a related ZMW cash deposit — both must be converted on the same basis and tested together against the threshold. The ZMW equivalent of the foreign currency transaction must appear in the CTR's transaction detail.

Linked Transactions, Not Same-Day Aggregation

Zambia's rule is not a same-business-day aggregation rule. Regulation 7 of SI 53 of 2022 covers a single currency transaction at or above the threshold and several transactions that appear to be linked. The test is whether transactions appear to be linked, not whether they fall on one business day, so monitoring has to look across days as well as across branches and channels, and institutions need a documented, consistently applied approach to deciding when transactions are linked. (Kenya takes a different line again: the FRC's position is that same-day sub-threshold cash transactions in a single account are not aggregated for CTR purposes, and suspected splitting is handled through an STR.)

Institutions with multiple branches must have a centralised transaction monitoring capability that can match customers across branches in real time. The NRC number (National Registration Card for individuals) and the PACRA registration number (Patents and Companies Registration Agency, for legal entities) are the primary identifiers for customer matching when identifying linked transactions.

As a matter of prudent practice, add the values of linked transactions together rather than netting deposits against withdrawals; it is the combined value that is compared with the threshold.

STR Filing Requirements for Zambian Institutions

Typologies Specific to Zambia

FIC Zambia has published typology guidance addressing money laundering risks specific to the Zambian economy. Compliance officers should ensure their transaction monitoring rules are calibrated to these typologies:

Mining sector proceeds: Zambia's copper and cobalt mining industry generates significant financial flows. Compliance red flags include unexplained cash-intensive businesses operating near mining districts, payments referencing mineral purchases or "brokerage" from unregistered entities, and high-value cash transactions inconsistent with the stated business profile of mining-adjacent businesses.

Cross-border cash movements: Zambia borders eight countries and has significant informal cross-border trade. High-value cash deposits following travel to border towns (Chirundu, Nakonde, Livingstone), transactions referencing informal trade in goods, and remittance patterns inconsistent with formal employment are known risk indicators.

Informal money transfer (hawala and equivalent): Zambia has a significant informal money transfer ecosystem, particularly serving cross-border remittances to and from DRC, Zimbabwe, Tanzania, and Mozambique. Transactions that appear to be hawala payments — structured to aggregate under thresholds, with no identifiable business purpose — are a priority typology for FIC Zambia.

Real estate layering: In Lusaka and Copperbelt, real estate transactions have been used as a layering vehicle. Cash-intensive construction payments, nominee property purchases, and real estate agents accepting large cash retainers are indicators the FIC has highlighted.

Narrative Requirements Under Zambian FIC Guidance

FIC Zambia has been explicit in its guidance that STR narrative quality is its primary data quality concern. Based on FIC feedback and mutual evaluation findings, Zambian STR narratives must:

State clearly and factually what transactions were observed, in what amounts and on what dates
Explain specifically why the observed transactions are inconsistent with the customer's known profile, business type, or financial history
Reference any customer explanation provided and why it was insufficient to resolve the suspicion
Connect the observed activity to a named typology or risk category where possible
Avoid vague characterisations such as "transaction appears unusual" without substantiation
Be written in clear English (Zambia's official reporting language for goAML submissions)

The FIC has issued feedback to reporting institutions whose STRs consistently fail these narrative standards, and the issue has featured prominently in BoZ AML/CFT examination findings.

Filing Deadline: Within 3 Working Days of Suspicion Forming

FIC Zambia's reporting deadline for STRs is three working days. Section 29 of the FIC Act requires a reporting entity that suspects property is the proceeds of crime, or is linked to terrorism or proliferation financing, to report to the FIC "not later than three working days after forming the suspicion", and the duty covers attempted transactions. The FIC's 2022 STR guidance note and the reporting forms in SI 54 of 2022 restate the same deadline. Kenya's window is shorter — two days after the suspicion arose — so groups operating in both markets cannot run one clock for both.

The three-working-day clock begins when a suspicion has been formed — not when an internal investigation is complete. If an alert is escalated to the compliance team and it is clear that reasonable grounds for suspicion exist, the clock starts. Internal review, additional due diligence, and narrative drafting must all be completed within three working days.

This requirement makes automated report preparation particularly valuable in Zambia: if the platform pre-populates the case with transaction data, customer identity, and a structured narrative template, the compliance officer's task is review and approval — not data assembly — and filing within three working days becomes consistently achievable.

Zambia-Specific XML Validation Rules

Occupation Fields — More Emphasis Than Kenya

FIC Zambia's goAML configuration places greater weight on occupation data for individual subjects than Kenya's FRC implementation. For every individual named in an STR or CTR — whether as an account holder, counterparty, or subject of suspicion — the XML must include:

Occupation (using the FIC-approved occupation codes)
Employer name (where the individual is employed)
Nature of business (for self-employed or business owners)
Source of funds (for high-value transactions)

These fields are technically optional in the base goAML XSD schema but are treated as required by FIC Zambia's validation configuration. Submissions that omit occupation data consistently receive data quality flags in FIC feedback. Compliance teams should ensure their core banking and KYC systems capture this data at onboarding and that it flows through to goAML XML generation.

Beneficial Ownership for Entities

Zambia's Companies Act requires the disclosure of beneficial ownership for companies registered with PACRA, and FIC Zambia has incorporated beneficial ownership requirements into its STR submission standards. When a legal entity (company, trust, partnership) is named in an STR, the XML submission must include:

The entity's full legal name and PACRA registration number
The entity's registered address
The names, NRC numbers, and ownership percentages of the beneficial owners — under the FIC Act, the natural persons who ultimately own or control the entity
Where beneficial ownership cannot be established, the reason must be stated in the narrative

Current FIC law sets no percentage threshold for beneficial ownership. The 25% "control" test that many institutions still apply came from the Financial Intelligence Centre (General) Regulations, 2016 (SI 9 of 2016), which SI 54 of 2022 revoked without restating a percentage. If your policy uses a percentage, treat it as an internal screening line and still identify anyone who ultimately owns or controls the entity below it.

This requirement reflects Zambia's obligations under FATF Recommendation 24 (transparency and beneficial ownership of legal persons) and is consistently checked during FIC inspections and mutual evaluation assessments. Institutions that cannot provide beneficial ownership data in their STR XML submissions are viewed as having a significant KYC gap.

NRC (National Registration Card) as Primary ID

For Zambian nationals, the National Registration Card (NRC) number is the mandatory identity document in FIC goAML submissions. The NRC is issued by Zambia's National Registration, Passport and Citizenship Authority (NRPCA) and takes a format of six digits, a hyphen, two digits, a hyphen, and one digit (e.g., 123456/78/9).

This specific format must be reproduced exactly in the XML. Unlike Kenya's National ID (8 digits, no formatting characters), the NRC includes hyphens that must be included in the XML value. Submissions that provide NRC numbers without the correct hyphenated format will fail FIC Zambia's field-level validation.

For non-Zambian nationals, a valid passport is the required identity document, with nationality, passport number, country of issue, and expiry date as mandatory fields.

For legal entities, the PACRA registration number serves as the primary identifier, formatted exactly as issued by PACRA.

Deploying an AML Platform for Zambia

Country Profile Configuration Approach

A well-architected AML reporting platform does not require separate software deployments for each country in which your institution operates. Instead, it uses a country profile configuration layer that stores each FIU's specific rules — thresholds, identifier formats, mandatory fields, indicator code sets, exchange rate methodology, and XML validation rules — as configuration data rather than hard-coded logic.

For Zambia, the country profile stores: the CTR threshold (the Kwacha equivalent of USD 10,000, with linked-transaction aggregation), the NRC format validation pattern, the FIC Zambia-specific occupation code dropdown, the institution's beneficial ownership rules, the three-working-day STR and CTR deadlines, and the FIC Zambia portal submission endpoint. When a compliance officer generates a CTR or STR for a Zambian transaction, the platform automatically applies Zambia's rules — not Kenya's or Uganda's.

This approach means that a bank operating in both Kenya and Zambia uses a single platform instance, and their compliance teams in both countries work in the same interface. The country-specific logic is handled transparently by the platform, without any action required from the compliance officer.

No Code Changes Required — Only Configuration Per Country

When FIC Zambia updates its XML requirements — for example, adding a new mandatory field or changing the format of an existing field — the platform vendor updates the Zambia country profile configuration. No code change, no new software version, no re-deployment. The same is true when thresholds change or new indicator codes are added.

This has a meaningful practical benefit: compliance teams are insulated from the technical complexity of maintaining XML schemas, and the vendor takes responsibility for keeping country configurations current as regulatory requirements evolve. This is particularly valuable in East Africa, where multiple FIUs are actively developing and updating their goAML implementations.

Multi-Country Deployment: Same Platform, Different Country Profiles

For financial groups with operations across multiple East African markets — a common structure for banks operating in, say, Kenya, Zambia, Uganda, and Tanzania — a multi-country AML platform provides a consolidated view of compliance performance across all jurisdictions while applying jurisdiction-specific rules to each submission.

The consolidated view enables regional compliance leadership to monitor CTR and STR filing rates, rejection rates, and outstanding cases across all markets in a single dashboard. Country-level compliance officers retain autonomy over their jurisdiction's submissions, but the regional CMLRO has oversight visibility they cannot achieve with country-specific tools.

Creodata's goAML platform includes country profiles for Kenya (FRC), Zambia (FIC), Uganda (FIA), Tanzania (FIU Tanzania), and Rwanda (FIC Rwanda), all maintained by our in-house compliance technology team.

Compliance Checklist for Zambian Reporting Entities

Use this checklist to assess your institution's readiness against FIC Zambia's goAML compliance requirements.

1. FIC Registration: Your institution is registered with FIC Zambia and has a current, active goAML portal account. Your designated Compliance Officer / MLRO is registered with the FIC and their contact details are up to date.

2. CTR Threshold Monitoring: You have a real-time or near-real-time monitoring capability that detects cash transactions at or above the Kwacha equivalent of USD 10,000, identifies linked transactions across all branches and channels, converts currencies using a documented exchange rate methodology, and gets CTRs to the FIC within three working days.

3. STR Detection Process: You have defined suspicious activity red flags aligned to Zambian typologies (mining, cross-border cash, informal remittances, real estate). Alerts are reviewed and escalated promptly, with a documented process for filing STRs within three working days of suspicion being formed.

4. XML Generation: Your CTR and STR XML is generated in accordance with goAML XSD v5.0.2 with FIC Zambia-specific rules applied — including NRC format, occupation fields, beneficial ownership for entities, and correct ZMW/foreign currency handling.

5. Pre-Submission Validation: Your XML is validated against the FIC Zambia schema and rule set before submission. Errors are corrected before the portal sees the file. Rejections at the FIC portal are the exception, and each one is traced to its cause.

6. Narrative Quality: Your STR narratives meet FIC Zambia's quality standards — factual, specific, referencing named typologies, explaining the basis for suspicion clearly. Vague or conclusory narratives are reviewed by the Compliance Officer before submission.

7. Beneficial Ownership: Your KYC onboarding process collects beneficial ownership information for all legal entity customers — the natural persons who ultimately own or control them, not only those above a percentage line. This data is captured in your CRM/core banking system and flows into STR XML submissions automatically.

8. Staff Training: All customer-facing staff and compliance team members have received AML/CFT training covering Zambian typologies, the FIC reporting obligation, and the tipping-off prohibition. Training records are maintained and updated annually.

9. Audit Trail: Every CTR and STR has a documented approval record showing who identified the case, who reviewed it, who approved it, and when it was submitted. The audit trail is immutable and available for FIC inspection.

10. Resubmission Process: You have a defined process for handling FIC portal rejections — identifying the error, correcting the XML, and resubmitting within the remaining window of the original deadline. The resubmission is documented in the case audit trail.

Frequently asked questions

What is the CTR threshold in Zambia?

The Kwacha equivalent of USD 10,000. A reporting entity reports any currency transaction equal to or above that amount, in Kwacha or foreign currency, whether it is a single transaction or several transactions that appear to be linked, within three working days (section 30 of the Financial Intelligence Centre Act and Statutory Instrument No. 53 of 2022). It applies to physical currency — cash deposits, withdrawals, foreign exchange and remittance payments; electronic transfers, cheques and card transactions are not counted, although they remain subject to the STR obligation.

How are US dollar cash transactions reported to FIC Zambia?

The threshold is itself set in US dollars, so a dollar cash transaction of USD 10,000 or more is reportable, and Kwacha or other-currency cash is converted at the day's rate to test it. Reports carry the original foreign amount, the ZMW equivalent and the exchange rate applied. Use one documented rate methodology — the institution's official buying rate, or the Bank of Zambia indicative rate — because inconsistent conversion is a data-quality finding the FIC raises at inspection.

What is the STR filing deadline in Zambia?

Not later than three working days after forming the suspicion, under section 29 of the Financial Intelligence Centre Act — longer than Kenya's two days. The duty covers attempted transactions. The clock starts at suspicion, so review, additional due diligence and the narrative must all fit inside those three working days.

Are same-day cash transactions aggregated for Zambian CTRs?

Not by calendar day. Zambia's rule covers a single currency transaction at or above the Kwacha equivalent of USD 10,000 and several transactions that appear to be linked, so the test is whether transactions appear to be linked, not whether they fall on one business day. Monitoring should therefore look across branches, channels and days, using the NRC number for individuals and the PACRA number for entities to match customers.

Deploy Zambia-Ready AML Reporting with Creodata

FIC Zambia's increasing enforcement activity and international scrutiny under ESAAMLG make 2026 a pivotal year for Zambian compliance programs. Institutions that rely on manual XML production, spreadsheet-based threshold monitoring, and generic narrative templates are carrying compliance risk they cannot afford.

Creodata's goAML AML Reporting Platform includes a fully configured Zambia country profile: USD 10,000-equivalent threshold monitoring with linked-transaction aggregation, NRC format validation, occupation field requirements, beneficial ownership XML support, and FIC Zambia portal integration. It is part of the same platform used for Kenya, Uganda, Tanzania, and Rwanda — so multi-market groups get consistent compliance operations across their entire footprint.

For the screening, transaction monitoring, customer risk rating and case management that sit around those filings, see AML compliance software in Zambia; for the goAML filing itself, see goAML reporting software for Zambia.

See the Zambia configuration in action — request your demo at creodata.com/demo.

Zambia FIC goAML Compliance: A Practical Guide for Banks