goAML reporting for Zambia: the FIC's portal, the three-working-day clocks and the files it accepts.
Suspicious and currency transaction reports built from the platform's cases and threshold rules, generated as goAML XML, validated against the schema and business rules before anything is uploaded to the Financial Intelligence Centre's portal, and kept in an immutable record of every filing. One module of the Creodata AML platform, licensed on its own or with screening, monitoring, risk rating and case management.
Zambia's rules in brief.
- Financial intelligence unit
- Financial Intelligence Centre (FIC), which receives reports electronically on its goAML portal at goaml.fic.gov.zm; a test environment runs on the same software version
- goAML in Zambia
- Implementation began in 2023 with a planned go-live in the third quarter of 2025; the actual go-live date is not published
- Portal settings
- XML schema version 5.0, Zambian kwacha, English only, at most 500 transactions per report and 10 attachments of 10,000,000 bytes each (portal configuration read on 1 October 2026)
- Suspicious transaction reports
- Not later than three working days after forming the suspicion, including attempted transactions (FIC Act s.29); the prescribed forms say to send them via the online portal
- Currency transaction reports
- Equal to or above the Kwacha equivalent of USD 10,000, single or linked, not later than three working days after the transaction (s.30; SI No. 53 of 2022, reg. 7)
- Who files
- Reporting entities, and accountable institutions under the same currency-transaction rule (SI No. 54 of 2022, Fourth Schedule)
- Before you file
- A compliance officer approved by the FIC, who obtains the portal credentials; the organisation registers on goAML with an Administrator and one to five attachments
- Records
- At least 10 years
- Missed or false reports
- Up to 700,000 penalty units and/or seven years (s.45); administrative sanctions up to one million penalty units (s.49C)
- Volumes in 2024
- 8,981 suspicious transaction reports, 96.9% of them from commercial banks, and 377,808 currency transaction reports (FIC Trends Report 2024)
- Next mutual evaluation
- Zambia's third-round mutual evaluation starts in December 2027 (National Risk Assessment 2025); the FIC's Trends Report 2025 says it is due in 2027
- Not published
- No FIC goAML user guide or registration notice; the report-type codes sit behind the portal login
Checked against primary sources on 5 November 2026.
What Zambia requires of a goAML filer, and how the module handles it
The reporting duties sit in sections 29 and 30 of the Financial Intelligence Centre Act, 2010, the two 2022 statutory instruments and the FIC's forms and guidelines; the portal's own settings decide what a file must look like. Each duty, where it sits, and the part of the module that carries it:
| What Zambia requires | Where it sits | How the module handles it |
|---|---|---|
| Submit suspicious transaction reports not later than three working days after forming the suspicion, via the online portal | FIC Act s.29; SI No. 54 of 2022, reg. 17 and Forms IV and V | Alerts become owned cases with a deadline, and the STR drafting workspace compiles the parties, accounts and narrative, so the approved report goes out as goAML XML inside the three working days. |
| Describe the factors behind the suspicion, whether the transaction is isolated or linked, the other parties involved, and at least one reason for suspicion | SI No. 54 of 2022, Form IV, Part C | The narrative and the reasons for suspicion are fields of the report, reviewed and approved in the case before the file is generated, so the MLRO reviews a complete report rather than assembling one. |
| Report currency transactions at or above the Kwacha equivalent of USD 10,000, single or linked, within three working days | FIC Act s.30; SI No. 53 of 2022, reg. 7 | Threshold rules test Kwacha and foreign-currency transactions against the line, bring transactions that appear to be linked together, and assemble the reports for the three-working-day window. |
| Capture who the transaction was for and who conducted it, cash in and out, the foreign-currency amount, the accounts affected and the transaction type | SI No. 53 of 2022, Schedule (the prescribed currency transaction report) | Ingestion maps those fields from core banking, teller and payment data, and a data-requirements view shows which attributes a report still lacks before the file is built. |
| Produce files the FIC's portal accepts: schema version 5.0, at most 500 transactions and 10 attachments per report | goAML portal configuration, 1 October 2026 | Every file is validated against the goAML XSD and business rules before it leaves your building, cash transaction reports are batched automatically against the portal's limits, and a manual download is available if the portal is down. |
| Keep records for at least 10 years, and a register of the reports made inside the institution and to the FIC | FIC Act; Bank of Zambia AML/CFT/CPF Directives, 2017, Directive 6 | An immutable record of every report, amendment and filing, with who filed what and when, exportable for an FIC or Bank of Zambia inspection. |
Summaries of the primary texts as checked on 1 October 2026 (the FIC Act and its 2016 and 2020 amendments, SI No. 53 and No. 54 of 2022, the FIC's forms and guidelines, the Bank of Zambia Directives, 2017, the FIC Trends Report 2024 and the goAML portal's public configuration) and of the FIC Trends Report 2025 on 4 November 2026. Not legal advice.
Frequently asked questions.
Does Zambian law require reports to be filed through goAML?
No provision names goAML. The FIC Act requires the FIC to keep a register of reporting entities (s.36A) and SI No. 54 of 2022 requires registration with a supervisory authority, but neither mentions the portal. The prescribed STR and CTR forms do say to send reports via the online portal, with email or post only in exceptional circumstances, and the FIC's portal says a user must log in to submit a report.
Which goAML schema version does the FIC use?
The production portal reported XML schema version 5.0 on 1 October 2026, with Zambian kwacha as the currency and English as the only language. The module is configured to the version the FIC's portal reports and maintained as it changes.
How many transactions fit in one report?
The portal's configuration allows at most 500 transactions per report and 10 attachments of up to 10,000,000 bytes each. Larger batches have to be split; the FIC has not published how it wants that done.
Can we test before filing to production?
The FIC runs a goAML test environment, labelled as such, on the same software version as production. We found no FIC statement that testing on it is compulsory.
What are the report codes for an STR and a CTR in Zambia?
They are not public: the portal's report-type list needs a login, and the FIC has published no goAML user guide. Once your organisation is registered, the codes the portal shows are set in the module's configuration for Zambia.
Does the module submit the report to the FIC for us?
It produces the validated goAML file and records the filing. The submission itself happens on the FIC's portal under your organisation's login, and the file can also be downloaded manually if the portal is down.
See it on your own data.
Bring your own customers and scenarios to a live demo of the AML compliance software, set up for the country you report in.