Account opening and KYC software for Tanzanian banks, microfinance institutions and SACCOS.
BAOS takes business, personal, group and joint applications through a staff review, starting from two Tanzania templates, and captures on your own forms the details the AML Regulations ask for: the national identity card as the primary document, the entity and its beneficial owners, and everyone who will sign. It is the account-opening workflow that sits beside your identity-verification provider and your core banking system, so NIDA checks, screening and booking the account stay where they run today.
- 10 yearsminimum retention of KYC files, counted from the end of the relationship
- 5%holding the AML Act treats as an indication of beneficial ownership, not a fixed test
- TZS 500NIDA fee per successful citizen ID query, under a data-sharing contract
- 3verification levels in the AML Regulations: basic, detailed and enhanced
What Tanzania's AML rules ask at account opening, and who does each part.
The Anti-Money Laundering Act (Cap. 423 R.E. 2023) and the Anti-Money Laundering Regulations 2022 (GN 397, amended by GN 10A and GN 853E of 2023) set customer due diligence for every reporting person, from banks to microfinance providers and SACCOS. BoT and the FIU enforce them, and we found no separate BoT KYC regulation. These rows cover Mainland Tanzania; under Zanzibar's own AML regulations, the Zanzibar resident identity card is also a primary ID document.
| The rule | Recorded in BAOS | Outside BAOS |
|---|---|---|
| The national identity card is the primary ID document. A passport, driving licence, voter's card or other listed ID is accepted only in set cases: a non-citizen who cannot get the card, a customer too young to hold one, a lost card backed by a police loss report, or a low-risk customer.AML Regulations 2022 (GN 397), reg 8(1)(a) and (b), as renumbered by GN 853E | The Tanzania personal template offers NIDA ID, passport, voter's ID and driving licence as ID types, with the applicant's identity, ID details, address, employment and income. Staff mark each document verified, one at a time or for the whole application. | Checking the card with NIDA, which the Regulations place under enhanced verification, through your verification provider or your own NIDA data-sharing contract. |
| When a customer's ID or an entity's registration document expires, the account is suspended until the document is renewed or replaced. While it is suspended, only deposits, withdrawals for existing loans, set charges or a lawful order, and closure are allowed.AML Regulations 2022 (GN 397), reg 8(1)(c) and (d) | The ID document details on each application. If your form does not already ask for the expiry date, your team adds the field in the form builder. | Watching expiry dates and suspending the account, in your core banking system. |
| For a legal person: its registered and trade names, address, type of business, registration document and the powers that bind it, TIN where applicable, the person in charge and the person opening the account. At moderate risk, add the certificate of incorporation, a board resolution, the ownership structure and the beneficial owners' names, dates of birth and gender.AML Regulations 2022, reg 2 (basic and detailed entity information), as amended by GN 10A | The Tanzania enterprise template records the entity's TIN, VAT number, business licence and region, district and ward address, with a slot for the BRELA certificate and each company document. Directors, shareholders and signatories sit on the same record. | The company's BRELA records, such as the certificate of incorporation, the register of directors and the annual return, from the applicant or BRELA. |
| Identify the natural persons who ultimately own or control the entity, then anyone who controls it by other means, then the senior managing official. A holding of 5% or more is an indication of ownership. For a trust: the settlor, trustees, any protector, the beneficiaries or class, and anyone else in control.AMLA s.3 (beneficial owner); GN 10A reg 8(1)(e) and (f); GN 853E reg 8B | Each beneficial owner's name, ID and shareholding as declared. BAOS applies no threshold and does not trace ownership through other companies. | BRELA's beneficial-ownership register, which Act No. 6 of 2026 opens to reporting persons (Companies Act s.457(g)). We found no form, fee or portal for that access yet. |
| Identify anyone acting for the customer, with their relationship to the customer and their authority to act. For an entity, that covers the person in charge and the person who says they are authorised to open the account.AMLA s.3 (customer due diligence, para (c)); GN 397 regs 2 and 9(l) | Each signatory with their ID and a document slot for it, and the operating mandate, chosen from eight. | ID checks on each signatory, with your verification provider. |
| Legal persons and arrangements give a TIN where applicable. Separately, the Tax Administration Act has financial institutions and cooperative societies require a TIN for all contracts; it does not name account opening, and no text we found settles whether an account agreement counts.GN 397 reg 2 (basic entity information (f)); Tax Administration Act, Cap. 438, s.25(2) and Third Schedule item 9 | The entity's TIN with a Tanzanian TIN format check, and an optional TIN certificate on the personal template. | Confirming the TIN with TRA, and your own policy on individual TINs. |
| SACCOS (Tier 3) are licensed by TCDC under powers delegated by BoT, and as reporting persons they apply the AML Act to their members. Community microfinance groups (Tier 4, ten to fifty members) register with their local government authority, receive a certificate on Form No. 3 and are not reporting persons; no rule says what a bank must collect for a group account.Microfinance Act 2018, ss.5 and 14; GN 675/2019 reg 4; GN 678/2019 regs 4 and 11; AMLA s.3 | The group form (shipped as a draft) records the group, its officials, a member register and the meeting resolution. SACCO is one of the fifteen business entity types, and a SACCOS can run BAOS for its own members. | The group's certificate and each official's ID checks. Banks set their own group document list; some ask signatories for a letter from the ward or village executive officer. |
| Keep KYC files and transaction records for at least ten years from when the transaction was completed or the business relationship formally ended.AMLA s.17(1)(b); GN 397 reg 22 | The application on the form version it was filled on, its documents, and an audit record of each workflow action with the user, role, time and IP address. | Your retention policy: BAOS has no retention or deletion tooling. |
Summaries of Creodata's Tanzania fact sheet, checked against primary sources on 9 October 2026. Not legal advice.
NIDA, the national identity card and the TIN.
The National Identification Authority (NIDA) registers people and issues the national identity card, which carries the National Identification Number (NIN). Under the AML Regulations the card is the primary ID document, and other IDs are accepted only in the listed exceptions (GN 397 reg 8(1)). Since February 2023 the identity regulations print an expiry date only on the cards of legal residents, refugees and stateless persons (GN 96 of 2023). We found no primary text on older citizen cards printed with an expiry date, so ask your supervisor how the suspension rule for expired IDs applies to them.
What the Regulations require is verification at a level set by risk. Basic verification means inspecting the document and matching its photo and details to the applicant; checking the document with its issuer (NIDA, or immigration for a passport) is part of enhanced verification (GN 397 reg 2). An institution that wants NIDA data applies to NIDA, signs a data-sharing contract and pays per successful query, and NIDA describes three channels: a system-to-system gateway, a secure portal and offline card readers. BAOS does not connect to NIDA: your identity-verification provider, or your own NIDA contract, runs that check, and staff record their review in BAOS. For online applications, note that the Regulations treat a customer who is not physically present, without proper safeguards, as an increased risk (reg 9(j)).
Since January 2023 the Tax Administration Act has the Commissioner General issue a TIN to every citizen registered with a NIN and link the two numbers (s.22(2)). The AML Regulations ask legal persons and arrangements for a TIN where applicable, while the Act's Third Schedule has financial institutions and cooperative societies require one for all contracts, without naming account opening (s.25(2)). BAOS checks the format of a Tanzanian TIN as it is typed; confirming it with TRA stays outside BAOS.
The Tanzania templates, ID types and Swahili form text.
Two Tanzania starter templates ship with BAOS. Tanzania personal account offers NIDA ID, passport, voter's ID and driving licence as ID types, income in TZS bands, a proof-of-residence document and an optional TIN certificate and introducer letter. Tanzania enterprise asks for the TIN, VAT number, business licence and an address by region, district and ward, with the BRELA certificate and other company documents. Some of their wording predates the 2026 changes to BRELA's company forms (GN 82/2026) and to the PEP definitions (Act No. 6 of 2026), so treat them as starting points your team reviews before publishing. On address, the Regulations ask for a residential address, or the village, ward or locality where there is none, but name no proof-of-address document, so decide whether that slot is required.
Option sets are editable, so your team can add the other IDs the Regulations list, such as employee or student cards, if your policy accepts them in the exceptions. Format checks ship for the Tanzanian TIN, passports and phone numbers; there is no NIN format check. Each field can carry English and Swahili text, which suits Tanzania: Kiswahili is the language of the laws (Interpretation of Laws Act s.84(1), since 2021), and BoT's consumer-protection rules have providers use English or Kiswahili according to the customer's preference (GN 298 of 2025, reg 15(3)). No other form language is available, and the staff interface is in English.
Tanzania's rules on where onboarding data and systems can sit.
The Personal Data Protection Act decides when personal data may leave Tanzania, and BoT's guidelines decide where a bank's systems may run. BAOS can run in either place:
Azure Marketplace
In your own Azure subscription, in the Azure region you choose. Azure has no region in East Africa; the nearest are South Africa North and South Africa West.
On-premises
In your own data centre in Tanzania, installed and supported by Creodata. Choose it where your rules keep data or systems in the country.
Register with the PDPC before processing
No one may collect or process personal data without registering with the Personal Data Protection Commission as a data controller or data processor, and registration lasts five years. Financial-transaction and biometric data are sensitive personal data, which need prior written consent unless the processing is necessary to comply with another written law.
Personal Data Protection Act, Cap. 44, ss.3, 14(1), 16(1) and 30; Personal Data Collection and Processing Regulations 2023 (GN 449C), reg 4
A PDPC permit to send personal data abroad
A transfer outside Tanzania needs an adequate framework in the receiving country or adequate safeguards. A controller or processor that intends to transfer applies to the Commission for a permit on Form No. 7, with proof of an agreement or a contract with the recipient; the Commission decides within fourteen days and issues the permit on Form No. 8. We found no general data-localisation rule in the Act or the 2023 Regulations.
Personal Data Protection Act, ss.31 and 32; GN 449C, regs 20 to 22
BoT outsourcing: KYC decisions and the primary data centre
Material outsourcing needs BoT's prior written approval. A bank may not outsource determining compliance with AML, CFT and KYC norms for opening accounts, and may not place its primary data centre outside the country.
BoT Outsourcing Guidelines for Banks and Financial Institutions, 2021, paras 7 and 10
BoT cloud rules: mission-critical systems stay in Tanzania
A financial service provider may not host a mission-critical system, or one whose data BoT considers critical, in a primary data centre or with a cloud provider whose infrastructure is outside Tanzania; customer deposit management is one of the examples. Other cloud use needs BoT's prior written approval, and BoT approves the contract before implementation. No BoT text says whether an account-opening system is mission-critical. A 2025 revision keeps the same bar, but it is unsigned, and BoT's regulations page still listed only the 2023 guidelines on 9 October 2026.
BoT Cloud Computing Guidelines for Financial Service Providers, 2023, paras 7(a), 8 and 10
Frequently asked questions.
Does BAOS check IDs with NIDA?
No. BAOS does not query NIDA, BRELA or TRA. The AML Regulations make the national identity card the primary document and put checking it with its issuer under enhanced verification (GN 397 regs 2 and 8). NIDA gives access through an application, a data-sharing contract and a fee of TZS 500 per successful citizen query (GN 96 of 2023). That check runs through your verification provider or your own NIDA connection, and your staff record their document review in BAOS.
Where is our data hosted?
Where you choose. BAOS runs from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata. Azure has no region in East Africa; the nearest are South Africa North and South Africa West. BoT's 2023 cloud guidelines bar hosting mission-critical systems outside Tanzania, its outsourcing guidelines bar a primary data centre abroad, and sending personal data abroad needs a PDPC permit. No BoT text says whether an account-opening system is mission-critical, so ask BoT; where your data or systems must stay in Tanzania, choose the on-premises deployment. The Enterprise AI features run on Azure AI services outside Tanzania.
Which Tanzania templates ship with BAOS?
Two. Tanzania personal account covers the NIDA ID, passport, voter's ID or driving licence, income in TZS bands, proof of residence and an optional TIN certificate and introducer letter. Tanzania enterprise covers the TIN (with a format check), VAT number, business licence, a region, district and ward address, the BRELA certificate and other company documents. Some of their wording predates the 2026 changes to BRELA's forms and to the PEP definitions, so your team reviews them in the form builder before publishing.
Can SACCOS use BAOS for member onboarding?
Yes. SACCOS are Tier 3 microfinance providers, licensed by TCDC under powers delegated by BoT (Microfinance Act 2018 s.14; GN 675/2019), and as reporting persons they apply the AML Act and GN 397 to their members. We found no SACCOS-specific member-KYC rule. BAOS runs personal, group, joint and business applications in one workflow; the business form is published by default, and the personal, group and joint forms ship as drafts the SACCOS adapts and publishes.
What changed for PEPs in October 2026?
The Written Laws (Miscellaneous Amendments) Act No. 6 of 2026, published on 2 October 2026, split politically exposed persons into domestic and foreign. Senior-management approval, source of wealth and funds and enhanced monitoring now always apply to foreign PEPs, and to domestic PEPs only in higher-risk relationships (AMLA s.16(2), as amended). The Act states no commencement date and we found no commencement notice, so confirm the start with the FIU or BoT. In BAOS, applicants make a PEP declaration and every person who needs screening is listed once; the screening runs in your screening tool, and BAOS does not rate risk.
Can we look up a company's beneficial owners at BRELA?
The law now allows it: Act No. 6 of 2026 adds reporting persons, which include banks, to those who may access BRELA's beneficial-ownership registers for companies and business names (Companies Act s.457(g); Business Names Act s.21(2)(f)). We found no form, fee or portal for that access yet, so do not plan on instant lookups. BAOS does not search BRELA: it records each owner's name, ID and shareholding as declared, for your team to compare with the register.
See BAOS set up for Tanzania.
Bring your account types, your document checklists and your hosting rules to a live demo, and see an application go from the applicant to your reviewers.