Account opening and KYC software for banks, MFIs and SACCOs in Zambia.
BAOS captures the due diligence the FIC Act and SI 54/2022 ask for at account opening, on forms your team builds: NRC or passport details, the TPIN, directors, beneficial owners, signatories and their documents, verified by your staff. It is the account-opening workflow that sits beside your identity-verification provider and your core banking system. Run it from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata.
- 10 yearsminimum time to keep account files and ID copies after the relationship ends (FIC Act s.22)
- 5%direct or indirect shareholding at which the Companies Act counts a beneficial owner, since 30 December 2025
- 15 daysfor a bank to report a beneficial-ownership discrepancy to PACRA in writing
- K10,000monthly income or average monthly withdrawals that SI 54/2022 lists as a low-risk marker for simplified due diligence
What Zambian law asks for at account opening, and what BAOS records.
Customer due diligence is set by the Financial Intelligence Centre Act, 2010 (Act No. 46 of 2010), Part III as amended in 2020, and the FIC (General) Regulations 2022 (SI 54/2022), for every reporting entity: banks and the other financial service providers under the Banking and Financial Services Act 2017, micro-financing included. The Bank of Zambia (BoZ) AML Directives 2017 add no due diligence rules, and the Banking and Financial Services Act 2026 has passed but awaits commencement. Each rule below is set against what BAOS records and what stays with the Patents and Companies Registration Agency (PACRA), the Zambia Revenue Authority (ZRA) or your verification provider.
| The rule | Recorded in BAOS | Outside BAOS |
|---|---|---|
| Individuals: obtain the full name, physical address (or a mobile number linked to a registered SIM card instead), and date and place of birth, and verify them against a driving licence, passport or national identification document bearing the person's photograph, or another listed source. For a foreign citizen, add the permit to reside in Zambia.FIC Act s.16(4)(a); SI 54/2022 reg 7(1)(a)(i) to (viii) | A field on your published form for each particular, the ID type and number (your team adds the NRC to the option set), and the ID copy in the document checklist, verified by staff. | Any check against the national register, with your identity-verification provider. The regulations allow one but do not require it (reg 7(1)(a)(vii)). |
| Customers not physically present: due diligence must be no less effective than face to face, with additional documentary evidence or supplementary measures to verify or certify the documents supplied. Non-face-to-face relationships are a high-risk factor.FIC Act s.18(b) and (c); SI 54/2022 Second Schedule Part II para 3(c) | Online applications through the customer portal and staff-captured ones on the same workflow, with extra document slots that form rules show only where they apply. | The supplementary measure itself, such as a register check or a video call, with your verification provider, and the higher risk rating: BAOS does not rate risk. We found no Zambian rule that names a remote-verification method. |
| Bodies corporate: the corporate name, head office, directors, proof of incorporation, the provisions on authority to bind it, and its ownership and control. Compare them with a certified true copy of the certificate of incorporation, review the TPIN and the Register of Companies, and verify every person who exercises direct or indirect control.FIC Act s.16(4)(b); SI 54/2022 reg 7(1)(b)(i) to (iii) | The entity type (one of fifteen), its details, directors and shareholders, the signatories and mandate, and a document slot for the certificate and each other item your checklist names. | PACRA's Register of Companies and its Legal Entity Printout, which lists directors, shareholders and beneficial owners and is valid only for the day it is obtained. |
| Identify each beneficial owner and take reasonable measures to verify them. The FIC Act sets no percentage; since 30 December 2025 the Companies Act counts at least 5% of the shares, ultimate effective control, or a substantial interest or benefit. A company must give the bank adequate, accurate and up-to-date beneficial-ownership information when the relationship starts.FIC Act s.16(6)(b); Companies Act s.3 and s.124A (Act No. 23 of 2025) | Each owner's name, ID and shareholding on the application, with every owner, director and signatory listed once for screening. BAOS applies no threshold and traces no ownership chain. | Comparing the owners with PACRA's Register of Beneficial Owners, and reporting a discrepancy to PACRA in writing within 15 days (s.329B). The screening runs in your screening tool. |
| Anyone acting for the customer: identify and verify them as an individual, and obtain a power of attorney, service level agreement or other proof of their authority. A signatory to an account counts as a customer.FIC Act s.16(4)(d) and s.2 ("customer"); SI 54/2022 reg 7(2) and 7(5) | Each signatory's identity and ID, the operating mandate (one of eight) and the board resolution, with a document slot for the power of attorney or other proof of authority. | ID checks for each signatory, with your verification provider. |
| A bank or financial institution must require a taxpayer identification number (TPIN) for account opening and holding. ZRA issues TPINs to entities and to individuals from age 16, and BoZ has told commercial banks not to open a new account without one.Income Tax Act s.45B (Acts No. 45 of 2016 and No. 16 of 2017) and s.2 (Act No. 24 of 2022); BoZ CB Circular 05/2020 | The TPIN as a field for each individual and entity, which your team can make required. No TPIN format check ships. | Any check of the TPIN with ZRA. For a body corporate, the regulations ask you to review it with the Register of Companies (reg 7(1)(b)(ii)). |
| Groups: SI 54/2022 sets out due diligence for individuals, bodies corporate, partnerships and trusts, and the FIC Act counts each signatory to an account as a customer. We found no law that registers savings groups such as chilimba or village banking groups.SI 54/2022 reg 7; FIC Act s.2 ("customer") | The group form: the member register, the elected officials, the group meeting resolution, and each signatory's identity and ID. | The group documents you accept. Banks commonly ask for a certificate of registration, a constitution and the signatories' IDs. |
| Keep account files and identity documents for at least ten years after the business relationship ends. Co-operatives keep records for at least ten years from the date of the transaction.FIC Act s.22(2)(a); SI 54/2022 Fourth Schedule para 4 | Each application on the form version it was filled on, with its documents and an audit record of each workflow action (user, role, time and IP address), in your own database. | Your retention and deletion schedule: BAOS has no retention tooling. |
Summaries of Creodata's Zambia fact sheet, checked against primary sources on 9 October 2026. Not legal advice.
The NRC, INRIS and the TPIN in a Zambian onboarding.
The national registration card (NRC) is issued under the National Registration Act (Cap. 126): the Chief Registrar keeps a register of persons aged sixteen or over, and registrars issue the card (ss.3, 5 and 8). Under the 2019 Regulations (SI 34/2019) citizens hold a green card and non-citizens a pink one, with ten rolled and ten plain fingerprints taken at registration, and SI 80/2021 prescribes new card forms with a contact chip. We found no instrument that sets a replacement deadline or declares older cards invalid. The Chief Registrar may give extracts of the register to a person the Minister authorises in writing, for a fee (s.5(2)); we found no published verification service for banks.
Banks must identify customers and verify their identity with reliable and independent source documents, data or information when opening an account (FIC Act s.16(1)(a)). SI 54/2022 reg 7(1)(a) says how: compare the particulars with the customer's driving licence, passport or national identification document bearing their photograph, or with another listed source such as a reference, a credit reference agency search or a utility bill. A check against the national register counts as another independent source, so it is allowed, but the regulations do not require one and we found no other rule that does. The 2025 National Risk Assessment found that INRIS, which links civil registration with ID issuance in a central biometric database, was not fully operational; its action plan gives completing INRIS to the Ministry of Home Affairs and Internal Security and its Department of National Registration, Passports and Citizenship, with Smart Zambia, and lists integrating banking systems with INRIS as a planned action, not a duty. Verification normally comes before the account opens (s.16(2)), but under simplified due diligence for a low-risk customer it may be completed afterwards, provided the bank can prove the low risk to the FIC or its supervisor (reg 9(2)(a) and 9(3)).
In BAOS the NRC is an ID type your team adds to the option sets: the applicant enters the number and uploads the card, and staff verify the document. BAOS does not look NRCs up, so any register or INRIS check comes from your identity-verification provider, and staff can record the outcome in a staff-only section of the application. The TPIN follows the same pattern. The Income Tax Act requires a bank or financial institution to obtain a TPIN for account opening and holding (s.45B), ZRA issues TPINs to entities and to individuals from age sixteen, and BoZ CB Circular 05/2020 told commercial banks not to open a new account without one. BAOS records the TPIN as a form field; it has no TPIN format check and no ZRA lookup.
Building Zambian forms in BAOS.
No Zambia template ships: BAOS's country templates are Kenyan and Tanzanian. Your team builds Zambian forms in the no-code form builder from the shared section library, starting from the business form (published by default) or the personal, group and joint forms (which ship as drafts), and adds Zambia's ID types, such as the NRC, passport, driving licence, Refugee Identification Card and residence permit, to the option sets. Add the TPIN, the SIM-linked mobile number and the PACRA registration details as fields, and relabel the PEP declaration with the FIC Act's term, "prominent influential person". The format checks that ship cover passport and phone numbers alongside Kenyan and Tanzanian IDs; none checks an NRC or a TPIN. Forms are published under four eyes, and each application stays on the version it was filled on.
Applicants apply online through the customer portal, or your staff capture the application for them. Bank agents are a different case: under BoZ's Agent Banking Directives 2022 an agent may collect account-opening forms but may not open accounts or carry out due diligence for account opening (dir. 8(h) and 9(h)), so the due diligence and the decision stay with your own staff, who claim the application, verify the documents and approve or reject it. English is Zambia's official language (Constitution Art. 258(1)), and BAOS forms and the staff interface are in English; each field can also carry Swahili text, but no other language.
Hosting rules for Zambian customer data.
The Data Protection Act 2021 requires personal data to be processed and stored in Zambia unless an exception applies, and the Bank of Zambia approves material outsourcing and offshoring in advance. BAOS can run in either place:
Azure Marketplace
In your own Azure subscription, in the Azure region you choose. Azure has no region in East Africa; the nearest are South Africa North and South Africa West.
On-premises
In your own data centre in Zambia, installed and supported by Creodata. Choose it where your rules keep data or systems in the country.
Personal data on a server or data centre in Zambia
"A data controller shall process and store personal data on a server or data centre located in the Republic" (s.70(1)). The Minister may prescribe categories of personal data that may be stored abroad (s.70(2)); we found no such prescription. Sensitive personal data "shall be processed and stored in a server or data centre located in the Republic" (s.70(3)), and the Act's definition of sensitive data includes race, marital status, ethnic origin, sex, genetic data and biometric data (s.2).
Data Protection Act 2021 (Act No. 3 of 2021), ss.2 and 70
Transfers abroad: consent and an approved route
Other personal data may be transferred abroad only where the data subject has consented and either the transfer uses standard contracts or intragroup schemes approved by the Data Protection Commissioner, or the Minister has prescribed that transfers are permissible; or where the Commissioner approves a transfer due to a situation of necessity (s.71(1)). s.71(4)(b) allows a transfer of sensitive data with explicit consent, which sits uneasily with s.70(3). We found no adequacy regulations or approved standard contracts, so confirm your position with the Commissioner. Controllers and processors must also register with the Commissioner (s.19).
Data Protection Act 2021, ss.19 and 71
Bank of Zambia approval before outsourcing or offshoring
A regulated entity needs BoZ's prior written approval to outsource material business activities, whether the provider is in Zambia or elsewhere, and offshoring needs BoZ's prior approval too (2014 Guidelines, paras 2.2, 2.3, 7.0 and 9.1). The 2023 Cyber and Information Risk Management Guidelines repeat the approval step and add a risk assessment and due diligence first, logical segregation of data held in the cloud, audit rights, and the return and irreversible deletion of data when the arrangement ends (para 9.1.9). We found no data-location rule in either.
BoZ Guidelines on Outsourcing 2014 (Gazette Notice No. 717 of 2014); BoZ Cyber and Information Risk Management Guidelines 2023 (Gazette Notice No. 668 of 2023), para 9.1.9
Critical information in banking, once designated
The Cyber Security Act 2025 lists banking and finance as a critical sector (s.8). Once the Zambia Cyber Security Agency designates critical information by Gazette notice (s.9), a controller "shall host critical information or critical information infrastructure within the Republic" unless the Agency authorises hosting abroad (s.12). We found no designation of banking information, and could not read the commencement order.
Cyber Security Act 2025 (Act No. 3 of 2025), ss.8, 9 and 12
Frequently asked questions.
Does BAOS check NRCs against the national register or INRIS?
No. BAOS records the NRC number and the card the applicant uploads, and staff verify the document. Zambian law asks a bank to compare the customer's particulars with a photo ID or another listed source (SI 54/2022 reg 7(1)(a)); a register check is allowed, but the regulations do not require one. The 2025 National Risk Assessment says INRIS was not fully operational and plans to integrate banking systems with it. If you check NRCs electronically, that check comes from your identity-verification provider.
Does every account in Zambia need a TPIN, or only business accounts?
The Income Tax Act lists account opening and holding at a bank or financial institution as a transaction for which a TPIN is required from any person (s.45B), and BoZ CB Circular 05/2020 told commercial banks not to open a new account without one, so it is not limited to business accounts. Since 1 January 2025 the same rule also applies to accounts at mobile money operators (Act No. 22 of 2024). We found no exemption for non-residents. Individuals under sixteen cannot hold a TPIN, and BoZ's student-account circular (CB Circular 04/2014) does not mention one, so agree your approach for minors with your supervisor. In BAOS the TPIN is a form field your team can make required; BAOS does not check it with ZRA.
What beneficial-ownership threshold applies in Zambia?
Two tests sit side by side. The FIC Act defines a beneficial owner by ultimate ownership or effective control, with no percentage. Since 30 December 2025 the Companies Act counts anyone who directly or indirectly holds at least 5% of a company's shares, exercises ultimate effective control, or has a substantial interest in or economic benefit from it, and PACRA's beneficial-ownership data follows that test. The texts do not say which one a bank must apply, so confirm with your supervisor. BAOS records each owner's name, ID and shareholding; it does not apply a threshold.
Can SACCOs and co-operatives use BAOS?
Yes. A co-operative society, including a savings and credit co-operative, is an "accountable institution" under the FIC Act and must carry out due diligence when it opens an account for a member: full name, physical address or SIM-linked mobile number, and date and place of birth, checked against a photo ID (SI 54/2022 Fourth Schedule), with records kept for at least ten years. Credit unions are registered by the Registrar of Co-operatives under the Co-operative Societies Act 1998; we found no Bank of Zambia licensing of SACCOs. BAOS handles member applications on the personal, group and business forms, and SACCO is one of its fifteen entity types when a SACCO opens its own account with a bank.
Can our customer data stay in Zambia?
Yes, if you choose the on-premises deployment. The Data Protection Act requires personal data to be processed and stored on a server or data centre in Zambia, with exceptions only under s.70(2) and s.71, and says sensitive personal data shall be processed and stored in Zambia (s.70(3)), although s.71(4)(b) allows a transfer with explicit consent. Azure has no region in East Africa (the nearest are South Africa North and South Africa West), so where your data must stay in Zambia, choose the on-premises deployment, installed and supported by Creodata in your own data centre. The Enterprise AI features run on Azure AI services (Claude on Azure AI Foundry runs in East US 2 or Sweden Central), so that processing is not in Zambia. On Azure, also check BoZ's prior-approval rules for material outsourcing and offshoring.
Which Zambia templates ship with BAOS?
None. The country templates are Kenyan and Tanzanian. For Zambia, your team builds the forms in the no-code form builder from the shared sections and the business, personal, group and joint forms, adds the NRC and other Zambian ID types to the option sets, and publishes them under four eyes. The passport and phone-number format checks ship; there is no NRC or TPIN format check.
See BAOS set up for Zambia.
Bring your account types, your document checklists and your hosting rules to a live demo, and see an application go from the applicant to your reviewers.