Digital account opening for Ugandan banks, MDIs and SACCOs, with every NIN, owner and signatory on one record.
BAOS takes business, personal, group and joint applications through the identification the AML Regulations 2015 ask for and Bank of Uganda's 2022 due-diligence guidelines build on, then through a staff review your team controls. It is the account-opening workflow that sits beside your identity-verification provider and your core banking system: NIRA checks run in your provider, and the account is opened in your core. Deploy it from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata.
- 10 yearsminimum period for keeping customer due-diligence and transaction records
- 5%shareholding at which Bank of Uganda's 2022 guidelines identify a beneficial owner
- 11 yearsvalidity of a national ID card from its date of issue
- 31 Mar 2027deadline for regulated institutions to update KYC and deal only with BoU-licensed large SACCOs
Uganda's due-diligence rules, and where they land.
The AML Act 2013 (as amended), the AML Regulations 2015 (amended in 2022 and 2023) and Bank of Uganda's AML/CFT Customer Due Diligence Guidelines of September 2022 set what an institution collects when it opens an account. BoU's guidelines cover commercial banks, credit institutions, MDIs, forex bureaus and money remitters; they do not name SACCOs, which have UMRA's 2023 AML guidance notes. Paraphrased:
| The rule | Recorded in BAOS | Outside BAOS |
|---|---|---|
| Citizens and residents produce a national ID card or an alien's ID card, plus any of a list of particulars such as address, phone and email, an employer's letter and a TIN where applicable. The Registration of Persons Act lists opening a bank account among the services that need a NIN or ID. Fingerprints are captured for all persons.Registration of Persons Act s.66(2)(d); AML Regulations 2015 reg 19(1) and (6), as amended 2023 | ID type and number, issue and expiry dates, addresses, contact details and employment, with document slots for the ID. Your team adds the NIN, the national ID card and the alien's ID card to the ID-type list. | Fingerprint capture, card-reader or fingerprint checks, and a NIRA confirmation where a citizen's identity is in doubt (reg 19(3)(a)), through your verification provider. |
| Local companies and other bodies: registered and trade name, address, proof of registration and its number, a certified copy of the authorisation to open the account, the people who manage, control or own it, financial statements and a TIN where applicable. Verify by comparing the incorporation documents with the Registrar's and physically checking the place of business.AML Regulations 2015 reg 21(1)-(2) | The business form for fifteen entity types: entity details, addresses, directors and shareholders with their IDs, the board resolution, and a document slot for each item on your checklist. | A URSB company search by registration number, and the visit to the head office or place of business. |
| Identify the natural persons holding at least 5% of a company's shares; if in doubt, or if no one controls through ownership, those who control it by other means; failing both, the senior managing official. Neither the AML Act nor the Companies Act sets a percentage. Companies keep a beneficial-owner register in Uganda and file it with the Registrar within 14 days.BoU CDD Guidelines 2022 para 9.1; Companies Act s.119A (as amended 2022); Companies (Beneficial Owners) Regulations 2023 regs 3 and 8 | Beneficial owners recorded with their ID and shareholding on the business application. BAOS does not apply the 5% test or trace ownership chains. | Applying the cascade, and any inspection of the company's register at URSB (Form 3, UGX 25,000). |
| A person acting for a customer proves their authority and is identified and verified. A customer includes a signatory to an account and anyone authorised to transact on it.AML Regulations 2015 regs 2, 18(2)(b) and 27 | Signatories with their own ID details and documents, and the operating mandate from eight, from singly to any four to sign. | ID checks on each signatory, through your verification provider. |
| A TIN is collected where applicable, and for every partner of a partnership. No provision tying the TIN to account opening was found in the Tax Procedures Code Act. A 2025 amendment provides for the NIN and the URSB registration number to be used as tax identification numbers.AML Regulations 2015 regs 19(1)(b)(iv), 21(1)(h) and 23(d); Tax Procedures Code (Amendment) Act 2025 s.2 | A tax-number field your team adds to the form for individuals and entities, captured without a format check. | Any check of the number with URA. |
| Self-help groups such as VSLAs, ROSCAs and SILCs register with the District Community Development Office and hold a certificate valid for one to three years. The 2015 Regulations and BoU's 2022 guidelines set no group-account list; BoU's 2010 AML Regulations ask clubs and societies for the constitution, the signatories' identities and supporting documents such as a certificate of registration.Tier 4 Act 2016 s.99; UMRA SHG Guidelines 2022 para 9.2; FI (AML) Regulations 2010 Schedule 1 para 3 | The group form: member register, elected officials and the group meeting resolution, with document slots your team sets for the constitution and the certificate. | Your policy on which group documents you accept. |
| By 31 March 2027, regulated financial service providers update their KYC practices and transact only with large SACCOs licensed by Bank of Uganda: those with voluntary savings above UGX 1.5bn and institutional capital above UGX 500m.MDI (Registered Societies) Regulations 2023 (SI 54/2023) reg 2; BoU public notice, 28 Sep 2026 | SACCO is one of the fifteen business entity types. Your team adds a licence field and document slot to the business form. | Confirming the SACCO's licence with Bank of Uganda. |
| Keep identification and transaction records for at least ten years from the latest of identification, transaction or closure. BoU also asks that they be available within 48 hours of a request.AML Act 2013 (as amended) s.7(3); AML Regulations 2015 reg 42(1); BoU CDD Guidelines 2022 para 6.5 | Each application stays on the form version it was filled on, with its documents and an audit record of every workflow action, in your own environment. Retention follows your policy. | Your retention schedule, and transaction records in your core banking system. |
Summaries of Creodata's Uganda fact sheet, checked against primary sources on 9 October 2026. Not legal advice.
NIRA, the NIN and the TIN: where the checks sit.
The National Identification and Registration Authority (NIRA) runs the National Identification Register under the Registration of Persons Act, gives each registered person a unique national identification number (NIN) and issues national and alien ID cards. The Act lists opening a bank account among the services for which a person must produce a NIN, a national ID card, or an alien's ID number or card (s.66(2)(d)). A national ID card is valid for eleven years from its date of issue (reg 19, as amended by SI 67 of 2024). NIRA began issuing alien ID cards in August 2026, and the AML Regulations already ask lawful residents for one (reg 19(1)(a)).
The AML Act asks banks to verify customers using reliable, independent source documents, data or information (s.6(3)), and the Regulations require a confirmation from NIRA where a citizen's identity is in doubt (reg 19(3)(a)). The Registration of Persons Regulations allow a card reader and a fingerprint match against the card or the register (reg 27). Bank of Uganda's 2022 guidelines do not mention NIRA. A bank or other third party gets access to NIRA's data by applying to NIRA on Form 1, with the consent of the person concerned and a fee (SI 66 of 2015, reg 3). Those checks run in your identity-verification provider or your own process; BAOS holds the NIN, the ID details and the documents, and records the staff review beside them.
The AML Regulations ask for a tax identification number (TIN) where applicable for individuals and entities, and for every partner of a partnership. We found no provision in the Tax Procedures Code Act that makes a TIN a condition of opening an account. A 2025 amendment provides for the NIN (for individuals) and the URSB registration number (for non-individuals) to be used as tax identification numbers, and URA asked taxpayers in May 2026 to update their records. The Act leaves that section's start date to a statutory instrument we have not found, so confirm with URA which number to record.
Forms for Uganda: built from shared sections, in English and Swahili.
No Uganda template ships with BAOS; the country templates are for Kenya and Tanzania. Your team builds Uganda's forms in the no-code builder from the shared sections, nearly forty prebuilt sections in nine areas, for business, personal, group and joint applicants (the business form is published by default; the other three ship as drafts). The ID-type lists are option sets your team extends with Uganda's documents, such as the NIN, the national ID card and the alien's ID card. Format checks ship for the KRA PIN, Kenyan ID, Tanzanian TIN, passport and phone numbers only, so a Ugandan NIN, TIN or URSB registration number is captured without a format check.
Uganda's official language is English, and the Constitution has named Swahili the second official language since the 2005 amendment (art.6). Each field in a BAOS form can carry English and Swahili text. No other form language is available, so there is no Luganda version, and the staff interface is in English.
Data protection and Bank of Uganda's data-centre rules.
Uganda's Data Protection and Privacy Act limits storing personal data abroad, and Bank of Uganda's 2024 guidelines add cloud and in-country data-centre rules for the institutions it supervises. BAOS can run in either place:
Azure Marketplace
In your own Azure subscription, in the Azure region you choose. Azure has no region in East Africa; the nearest are South Africa North and South Africa West.
On-premises
In your own data centre in Uganda, installed and supported by Creodata. Choose it where your rules keep data or systems in the country.
Storage outside Uganda needs equivalent protection or consent
A controller or processor based in Uganda that stores or processes personal data abroad must ensure the country protects it at least as well as the Act does, or that the data subject has consented. Onward transfer to a third country needs express consent. The Personal Data Protection Office is to list adequate countries in the Gazette; for a country not listed, the controller must prove adequacy.
Data Protection and Privacy Act 2019 s.19; Data Protection and Privacy Regulations 2021 reg 30
Register with the PDPO every year
Every data collector, processor and controller registers with the Personal Data Protection Office. Registration lasts twelve months and costs UGX 100,000. The application names any country data may be transferred to and carries a sworn undertaking not to process or store personal data outside Uganda unless that country has equivalent protection or the transfer is otherwise permitted. The PDPO sits under NITA-U, which a 2024 Act dissolves with effect three years after its publication in the Gazette.
Data Protection and Privacy Regulations 2021 regs 15, 16 and 20, Schedule 2 and Form 3; NITA-U (Amendment) Act 2024 s.1
90 days' notice before a cloud contract
Institutions supervised under the Financial Institutions Act and the MDI Act notify Bank of Uganda at least 90 calendar days before contracting a cloud provider for critical services, for a risk assessment and a No-Objection, and the board approves cloud use. Cloud storage and processing of financial and personal data is limited to jurisdictions whose laws or treaties give the same level of protection, and outsourcing contracts must give BoU access to the provider's facilities.
BoU Cyber and Technology Risk Management Guidelines 2024, paras 1.2, 3.3 and 3.4
In-country primary data centres and recovery sites
The same guidelines require every supervised institution to have an in-country primary data centre and disaster-recovery site, as stipulated in a Bank of Uganda directive of 5 November 2015.
BoU Cyber and Technology Risk Management Guidelines 2024, para 3.4
Frequently asked questions.
Does BAOS check NINs with NIRA?
No. The Registration of Persons Act requires a NIN or national ID card to open a bank account (s.66(2)(d)), and the AML Regulations require a NIRA confirmation where a citizen's identity is in doubt (reg 19(3)(a)). Access to NIRA's data is by application to NIRA on Form 1, with the person's consent and a fee (SI 66 of 2015, reg 3). BAOS records the NIN, the ID card details and the documents, and staff record their review; any NIRA, card-reader or fingerprint check runs in your identity-verification provider or your own process.
Which Uganda templates ship with BAOS?
None. BAOS's country templates are for Kenya and Tanzania. For Uganda, your team builds each form in the no-code builder from the shared sections and adds Uganda's ID types, such as the NIN, the national ID card and the alien's ID card, to the option sets. Format checks ship for the KRA PIN, Kenyan ID, Tanzanian TIN, passport and phone numbers only, so a NIN, TIN or URSB registration number is captured without one. Forms change without a software release and are published under four eyes.
Where is our data hosted, and can it stay in Uganda?
Where you choose: from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata. Azure has no region in East Africa; the nearest are South Africa North and South Africa West. Bank of Uganda's 2024 guidelines require the institutions it supervises to have in-country primary data centres and disaster-recovery sites, so where your data must stay in Uganda, choose the on-premises deployment. Any processing outside Uganda needs equivalent protection or the data subject's consent (Data Protection and Privacy Act s.19). The Enterprise AI features run on Azure AI services (Claude on Azure AI Foundry runs in East US 2 or Sweden Central), so AI processing is not in Uganda.
Can SACCOs use BAOS for member onboarding?
Yes. A SACCO must be a registered co-operative with a UMRA licence and may serve only its members (Tier 4 Act s.36); a SACCO with voluntary savings above UGX 1.5bn and institutional capital above UGX 500m is licensed by Bank of Uganda instead (SI 54/2023). SACCOs register with the FIA as accountable persons, and UMRA's 2023 AML guidance notes ask them to establish each client's identity through KYC and due-diligence measures. BAOS runs personal, group and business applications for members; staff then open the member in your core SACCO system and record the account number in BAOS. Parliament passed a Bill in November 2024 to move UMRA's functions to the Ministry of Finance, but we found no assent, so check UMRA's status with the regulator.
Can customers open an account online in Uganda?
Yes, with specific measures. The AML Act requires adequate measures when an account is opened for a customer who is not physically present, and policies for non-face-to-face relationships (s.6(11) and (25)). Bank of Uganda's 2022 guidelines apply the same standards as for customers seen in person, with measures such as certified documents, additional documents and independent contact with the customer (para 9.7). BoU's 2010 AML Regulations, still published, say local applicants should not open accounts by post, so the texts conflict; confirm your approach with Bank of Uganda. In BAOS, applicants apply online through the customer portal, or staff capture the application for them; the remote identity check comes from your verification provider.
Does BAOS run the screening Bank of Uganda and the FIA expect?
No. Bank of Uganda's 2022 guidelines ask supervised institutions to screen every new customer against the UN Security Council 1267 and 1373 lists before onboarding, and to check names for PEP, sanctions and adverse-media risk (para 6.6). The FIA's directive of 5 September 2026 requires accountable persons to check within four hours whether a newly designated person is a customer, and to freeze their funds. BAOS lists every person who needs screening (directors, beneficial owners, members, holders and signatories) once each, on the application, and the PEP self-declaration BoU asks account-opening documents to include is made in the application (para 9.3.7(a)). The screening itself runs in your screening tool.
See BAOS set up for Uganda.
Bring your account types, your document checklists and your hosting rules to a live demo, and see an application go from the applicant to your reviewers.