Customer risk rating for Kenya, built on your regulation 7 assessment and the national risk assessment.
A six-factor model (country, industry or business type, product, delivery channel, customer behaviour, and PEP or sanctions exposure) whose weights and bands you set from your institutional risk assessment and Kenya's national risk assessment findings, with four-eyes overrides and periodic reviews scheduled by risk band.
Kenya's rules in brief.
- Institutional risk assessment
- Every reporting institution assesses and documents its ML, TF and PF risks, considering customers, countries, products, services, transactions and delivery channels (POCAML Regulations 2023, reg 7)
- Updates
- At least every two years, with Board-approved policies, and a separate assessment before new products, practices or technologies (regs 7(5) and 8)
- National findings
- Higher risks identified at national, sectoral or institutional level are met with enhanced measures or built into your risk assessments (reg 20(2))
- FRC directive
- FRC Circular No. 7 of 2023 directs reporting institutions to build national risk assessment findings into their risk assessments and customer risk profiles
- Kenya's assessments
- The 2021 ML/TF national risk assessment (launched 27 July 2022), the 2023 updates and the FRC's February 2025 ML and TF guidance; there is no separate 2025 assessment
- Enhanced due diligence
- Required where money laundering and terrorism financing risks are higher (reg 20(4))
- Beneficial owners
- Identified for every legal-person customer, whatever its risk (FRC Circular No. 5 of 2023)
- Review intervals
- No Kenyan text fixes an interval for each rating; set them in your Board-approved policy, with event triggers
Checked against primary sources on 19 October 2026.
What Kenya requires, and how the module handles it
Kenya's risk-based duties sit in the POCAML Regulations, 2023 and the FRC's circulars. Each duty, where it sits, and the part of the risk-rating module that carries it:
| What Kenya requires | Where it sits | How the module handles it |
|---|---|---|
| Consider customer, country, product, service, transaction and delivery-channel risk | POCAML Regulations 2023, reg 7(2)(b) | Six factors: country, industry or business type, product, delivery channel, customer behaviour, and PEP or sanctions exposure, each weighted and banded to match your risk assessment. |
| Reflect national and sectoral risk findings in your risk assessments and customer risk profiles | Reg 20(2); FRC Circular No. 7 of 2023 | Weights and risk bands are configuration, so compliance can change the model as the business or the national risk assessment changes, and every change is recorded. |
| Apply enhanced due diligence where risk is higher | Reg 20(1) and (4) | High-risk customers go into an enhanced due diligence workflow, so a high-risk file does not go stale. |
| Keep customer data and ratings current, with higher-risk customers reviewed more often | Reg 35(b); CBK's 2025 customer due diligence guidance | Periodic reviews are scheduled automatically by risk band. |
| Document the assessment and apply Board-approved policies consistently | Reg 7(2) and (3) | Any manual override needs a second authorised reviewer and a recorded reason, so each rating has a controlled history. |
| Include beneficial owners and PEP exposure in the picture | FRC Circular No. 5 of 2023; reg 26 | Entity resolution and a beneficial-owner graph link companies to the people behind them, and PEP or sanctions exposure is one of the six factors. |
Summaries of the primary texts as checked on 19 October 2026: the POCAML Regulations 2023, FRC Circulars No. 5 and No. 7 of 2023, Kenya's national risk assessments and CBK's 2025 guidance. Not legal advice.
Frequently asked questions.
What does Kenyan law require for customer risk rating?
Regulation 7 of the POCAML Regulations, 2023 requires a documented ML, TF and PF risk assessment that considers customers, countries, products, services, transactions and delivery channels, updated at least every two years. Regulation 20 requires enhanced due diligence where risk is higher.
Do we have to use Kenya's national risk assessment?
Yes. Regulation 20(2) says higher risks identified at national, sectoral or institutional level are met with enhanced measures or built into your risk assessments, and FRC Circular No. 7 of 2023 asks for updated risk assessments and customer risk profiles. Because the documents rate some sectors differently, record which document and date each weight relies on.
Is there a 2025 national risk assessment for Kenya?
No separate one was found. The FRC's February 2025 ML and TF guidance summarises the 2023 and 2024 work; the main reports are the 2021 assessment, launched on 27 July 2022, and the 2023 updates.
How often must customer risk ratings be reviewed in Kenya?
No Kenyan text sets a fixed interval for each rating. Set intervals by band in your Board-approved policy, review higher-risk customers more often, and re-rate on events such as a new national assessment, a new product or a customer becoming a PEP.
Can compliance change the weights without IT?
Yes. Weights and risk bands are configuration, and every change and every override is recorded, with overrides needing four-eyes approval.
See it on your own data.
Bring your own customers and scenarios to a live demo of the AML compliance software, set up for the country you report in.