A Kenyan bank or payment service provider is a reporting institution under the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA). That status brings a fixed set of duties: register with the Financial Reporting Centre (FRC), assess your money laundering risk, verify customers and their beneficial owners, keep records for seven years, report suspicious transactions to the FRC within two days of forming the suspicion and report cash transactions at or above USD 15,000 by the Friday of the same week. The Central Bank of Kenya (CBK) supervises banks and payment service providers for compliance with that law. The person who ties it all together is the Money Laundering Reporting Officer (MLRO), who must sit at management level with the competence, authority and independence to decide what goes to the FRC.
This guide is for MLROs and compliance heads at Kenyan banks, payment service providers and the foreign groups that own them. It works from the revised Act, the 2023 Regulations, CBK and FRC guidance and the CBK consultation drafts published in September 2026, as they stood on October 14, 2026. It is a practical reading of those texts, not legal advice. Where a document is still a draft, we say so.
Check that each link explains the next: the board-approved risk assessment explains the policy, the policy explains the customer file, and the customer file explains every report, every decision not to report and the date the suspicion arose.
A Kenyan bank or payment service provider is a reporting institution under POCAMLA. It must register with the Financial Reporting Centre, assess its money laundering risk, verify customers and beneficial owners, keep records for seven years, report suspicious transactions to the FRC within two days of the suspicion and report cash transactions at or above USD 15,000 by the Friday of the same week. The CBK supervises, and the MLRO decides what goes to the FRC.
Two bodies matter most to a bank or payment provider, and they do different jobs.
The CBK is the supervisor. Its AML/CFT/CPF page says it is responsible for supervising and enforcing compliance with POCAMLA and its regulations for the financial institutions under its purview. Its list covers commercial banks, mortgage finance companies, microfinance banks, money remittance providers, foreign exchange bureaus, digital credit providers, payment service providers and mortgage refinance companies. For banks, the CBK has also issued a guideline on anti-money laundering and combating the financing of terrorism under section 33(4) of the Banking Act.
The FRC is Kenya's financial intelligence unit, established under section 21 of POCAMLA. It receives the reports. Every reporting institution must register with the Centre, and suspicious transaction reports, cash transaction reports and sanctions freeze reports all go to it. The FRC can also impose its own civil penalties when an institution breaches its instructions, directions, rules or guidelines.
POCAMLA's First Schedule lists the other supervisory bodies. They include the Insurance Regulatory Authority, the Betting and Licensing Control Board and the Capital Markets Authority, among others. A group that holds both a banking licence and a capital markets licence in Kenya therefore answers to more than one supervisor, but files with one FRC.
| Body | Role for a bank or payment provider | What it expects from you |
|---|---|---|
| Central Bank of Kenya | AML supervisor for banks, payment service providers, remittance providers, digital credit providers and others | A working program, inspection-ready evidence and, under the draft 2026 guideline, an annual risk assessment submission |
| Financial Reporting Centre | Financial intelligence unit and receiver of reports | Registration, STRs, CTRs, sanctions freeze reports, and answers to follow-up requests |
| Capital Markets Authority and other First Schedule bodies | Supervisors for other licensed activities | The same POCAMLA duties, applied to their sector |
For a plain-language definition of the grey list Kenya is on, see our FATF grey list glossary entry. Our Kenya jurisdiction overview gives market background for foreign banks entering Kenya.
Kenya's framework rests on one Act, one set of regulations and a layer of supervisor guidance. Most of it was reworked in 2023.
The primary statute is the Proceeds of Crime and Anti-Money Laundering Act, No. 9 of 2009. The FRC publishes it as a Revised Edition 2023, which folds in the amendments made by Act No. 10 of 2023. The Act applies to any "reporting institution", which it defines as a financial institution and designated non-financial business and profession. A financial institution under the Act includes any business that transfers funds or value by any means, including both formal and informal channels, or that issues and manages means of payment such as electronic money. That definition is why a payment service provider carries the same core duties as a bank.
The Proceeds of Crime and Anti-Money Laundering Regulations, 2023 sit beneath the Act. They were published as Legal Notice No. 153 in Kenya Gazette Supplement No. 181 on October 6, 2023. The Regulations hold most of the working detail: the risk assessment, the MLRO, the cash reporting deadline and much of the due diligence content.
The CBK layer sits on top. Banks follow the CBK guideline issued under the Banking Act. Mobile payment services have had their own CBK anti-money laundering guidelines since 2013, issued under the National Payment System Act.
Two newer laws change the edges of the picture. The Virtual Asset Service Providers Act, 2025 was assented to on 15 October 2025 and commenced on 4 November 2025. It names the Capital Markets Authority and the Central Bank of Kenya as regulatory authorities, and it says nobody may carry on virtual asset services in or from Kenya unless licensed by the relevant regulatory authority. Providers already operating had one year from commencement to comply.
Two drafts from September 2026 are worth tracking, because both will change what an MLRO has to evidence.
On September 10, 2026, the CBK invited public comment on draft revised prudential guidelines, risk management guidelines and guidance notes. It has asked for comments by November 7, 2026. The AML part of that package is draft prudential guideline PG 08 on AML, CFT and proliferation financing, which is in the CBK's draft guidelines download (ZIP). It applies to all institutions licensed under the Banking Act and their foreign branches and subsidiaries. We cover what it proposes in the bank section below. Until the CBK issues it in final form, treat it as a strong signal of direction, not a rule in force.
The second draft is for payments. The National Treasury and the CBK have developed a draft National Payment System Policy and a National Payment System Bill, 2026. The Bill intends to repeal the National Payment System Act, Cap. 491A. Payment providers should expect their licensing and conduct framework to move, even though their POCAMLA duties stay the same.
Yes, as of the latest FRC circular we could verify. The FRC's High Risk Jurisdictions Circular No. 1 of 2026, dated February 27, 2026, summarizes the outcome of the FATF meeting held in Mexico City on February 11 to 13, 2026. It lists Kenya among the jurisdictions previously identified as having strategic deficiencies, on which the FATF published updated information. The FATF publishes these outcomes after each plenary, which it holds three times a year, in February, June and October. Check the FRC's circulars after each plenary for the current position. We could not retrieve the FATF's own pages directly for this update, so the status above rests on the FRC circular.
The grey-list status cuts two ways for a Kenyan MLRO. Your own institution must still apply enhanced due diligence to customers from higher-risk countries under section 45A, and send the FRC an annual report listing customers from those countries. Separately, your foreign correspondents may ask you for more evidence while Kenya stays under increased monitoring. A clean, replayable file helps with both.
The duties below apply to every bank and payment service provider, and they connect into one evidence chain. The board-approved risk assessment sets the policy. The policy sets what goes into each customer file. The customer file has to support every STR and CTR, and the MLRO's written findings explain every decision not to report. Seven-year records let an inspector rebuild the chain.
The table shows where each duty comes from and the evidence an inspector is likely to ask to see.
| Duty | Where it comes from | Evidence an inspector expects |
|---|---|---|
| Register with the FRC | Section 47A of the Act | Registration record, and change notices within 90 days |
| Risk assessment | Regulation 7 | Documented assessment, updated at least every two years, and board-approved policies that follow from it |
| New technology risk assessment | Regulation 8 | An assessment completed before the product or technology launched |
| Customer and beneficial owner verification | Section 45 | Identity records, and the beneficial owner verified from a reliable source |
| Enhanced due diligence for higher-risk countries | Section 45A | EDD files, and the annual report to the FRC listing customers from higher-risk countries |
| Records | Section 46 | Transaction and identity records kept for at least seven years |
| Internal reporting | Section 47 and Regulation 12 | A named MLRO, staff escalation routes and the MLRO's decisions |
| Suspicious and cash transaction reports | Section 44 and Regulations 38 and 40 | Reports filed on time, with written findings kept |
Every reporting institution must undertake a risk assessment, document it and keep it up to date. The Regulations require you to consider all the relevant risk factors, including customers, countries or geographical areas, products, services, transactions or delivery channels. On the basis of the results, the institution must develop and implement board-approved policies, controls and procedures to manage the risks it found. You must update the risk assessment policies or programs at least once every two years.
New products need their own assessment first. Regulation 8 requires a risk assessment before you introduce a new product, new business practice or new technology, for both new and pre-existing products. In our reading that includes any AI or automation you add to your AML process, so an MLRO who brings in an AI agent layer should expect to show the assessment that came before it.
If you need a starting structure, our AML risk assessment template sets out the factors and scoring an assessment usually records.
Section 45 requires you to identify and verify every applicant and customer, permanent or occasional, against an official record. When someone appears to act for another person, you must take reasonable measures to identify and verify the beneficial owner using information or data obtained from a reliable source. The Regulations define a beneficial owner as a natural person who ultimately owns or controls a customer, or the natural person on whose behalf a transaction is being conducted.
For customers connected to higher-risk countries, section 45A requires enhanced due diligence and proportionate countermeasures. One of those countermeasures is easy to miss: an annual report to the FRC listing customers that originate from the higher-risk countries.
Section 46 requires transaction and identity records to be kept for at least seven years from the date the business or transaction was completed, or from the end of the account or relationship. The FRC can require a longer period in writing. The same seven-year rule applies to your written findings on unusual transactions under section 44.
All reporting institutions must register with the FRC within the period and in the manner the Centre prescribes. Changes to the registered particulars must be notified in writing within 90 days, and failing to register at all is an offence.
Kenya has three report types that reach the FRC from a bank or payment provider. Each has its own trigger and clock.
| Report | Trigger | Deadline | Source |
|---|---|---|---|
| Suspicious transaction or activity report (STR) | Suspicion that a transaction or activity could relate to money laundering, terrorism financing, proliferation financing or the proceeds of crime, including attempted transactions | Within two days after the suspicion arose | Section 44(2) and (3), Regulation 38 |
| Cash transaction report (CTR) | Cash transactions at or above USD 15,000 or its equivalent, suspicious or not | By the Friday of the week the transaction occurred | Section 44(6), Fourth Schedule, Regulation 40 |
| Sanctions freeze report | Funds or assets frozen, or other action taken, under a sanctions list, including attempted transactions | Within 24 hours, to the Committee through the FRC | FRC targeted financial sanctions guidance |
Section 44(2) requires a reporting institution to report a suspicious or unusual transaction or activity to the Centre within two days after the suspicion arose. Regulation 38 says the same. The duty covers attempted transactions too. A report must be accompanied by copies of all documentation directly relevant to the suspicion and the grounds on which it is based.
For each STR case, keep these records together so the clock can be proven later:
You may see a different number elsewhere. The FRC's own May 2025 guidance on suspicious transaction and activity reporting still says a report must be sent immediately and in any event within seven days of the date the suspicious transaction or activity occurred. The CBK's 2013 mobile payment guidelines use a similar seven-day wording. The CBK's 2026 draft guideline for banks proposes 48 hours from when the suspicion arises. The Act and the 2023 Regulations are the binding texts, so our reading is to plan around two days from the moment of suspicion. Ask your counsel to confirm how your institution records that moment, because the clock runs from suspicion, not from the transaction date.
The FRC can come back to you. It may ask in writing for further particulars and documents, and you have to answer within a reasonable time and in any case no later than thirty days from receiving the request. Your written findings on unusual transactions matter here: a financial institution must examine the background and purpose of those transactions as far as possible and set out its findings in writing.
The FRC treats the STR as protected. Its guidance says the name of the individual who submitted the STR is never revealed. The same guidance is clear that judgment matters: a single indicator is not necessarily enough for reasonable grounds to suspect, and your knowledge of your industry and your clients, with your overall judgment, decides whether an indicator is relevant to a particular transaction.
For how FATF frames this duty internationally, see our page on FATF Recommendation 20 and suspicious transaction reporting.
The cash threshold is in US dollars, not shillings. Section 44(6) of the Act requires reports on all cash transactions equivalent to or exceeding the amount in the Fourth Schedule, whether they appear to be suspicious or not, and the Fourth Schedule sets that amount at USD 15,000 or its equivalent in any other currency. Regulation 40 uses the same "equivalent to or exceeding" wording. The report goes to the FRC electronically, by the Friday in the week in which the transaction occurred, unless the Centre specifies another time. The Fourth Schedule on its own says "exceeding", so the safer reading is to report from USD 15,000 upward, as section 44(6) and Regulation 40 put it. That is our reading, not FRC guidance, so confirm it with your counsel.
A CTR is not a judgment about the customer. An STR is. Filing a CTR never discharges the separate duty to consider whether the same activity is suspicious.
Key insight: in Kenya the STR clock starts when the suspicion arises, not when the transaction happens or when someone finishes reviewing it. An MLRO who can show the date of suspicion, the written findings and the filing date for every case has the answer to the first question an inspector asks.
The FRC's civil penalty power is in section 24B. For breaching or failing to comply with the Centre's instructions, directions, rules or guidelines, a natural person is liable to a penalty of up to five million shillings, and a corporate body up to twenty-five million shillings. Continued failure adds ten thousand shillings for each day it continues, for up to one hundred and eighty days. Those civil penalties sit alongside the criminal offences in the Act, which can carry imprisonment.
Kenya's law puts one named person at the center of the reporting chain, and it is specific about who that person can be.
Every reporting institution must appoint an MLRO under Regulation 12. The MLRO must be at management level and have the relevant competence, authority and independence. An internal auditor or a chief executive cannot be appointed MLRO, unless the chief executive is a sole proprietor. You must tell the FRC and your supervisor within fourteen days of appointing or removing the MLRO.
The reporting line runs through that person. All staff must monitor and report suspicious activity to the MLRO. Section 47 of the Act requires internal procedures that let the MLRO see the information needed to decide, and that require the MLRO to report directly to the FRC when they determine that a sufficient basis exists. The CBK's draft 2026 guideline would go further for banks: an MLRO at senior management level who reports directly to the board or a designated board committee. Its list of MLRO duties begins with receiving and reviewing suspicious transaction reports from staff, and filing STRs with the FRC.
The practical consequence is that software can collect, link and draft, but the decision that a sufficient basis exists, and the decision not to report, belong to the MLRO. If you want a refresher on the role itself, our MLRO glossary entry covers it.
The board approves the risk assessment and policies, staff escalate to the MLRO, any AI agent layer prepares the case within limits the institution sets, the MLRO decides what is reported, and the CBK and FRC supervise and receive what the law requires.
| Component | Responsibility | Boundary |
|---|---|---|
| Board of directors | Approves the risk-based policies, controls and procedures, and (under the CBK draft) oversees the AML program with direct MLRO reporting. | Does not decide individual suspicious transaction reports. |
| Front-line staff and agents | Collect identity and transaction information and report suspicious activity to the MLRO. | Never tip off the customer; agents act under the provider's agreements and monitoring. |
| AI agent layer (optional) | Links transactions, traces beneficial owners, screens parties and drafts STRs and CTRs from the case evidence. | Does not file with the FRC, acts only within the autonomy the institution sets, and stops when the kill switch is used. |
| MLRO | Reviews escalations, writes findings, decides whether a sufficient basis exists and files with the FRC. | Remains accountable for reporting decisions whatever the software does. |
| CBK and FRC | The CBK supervises and inspects; the FRC registers reporting institutions, receives reports and can impose civil penalties. | External bodies; the institution does not delegate its duties to them. |
The board approves the risk assessment and policies, and the MLRO decides every report to the FRC and records the reasons, including decisions not to report. Any AI agent works only within the autonomy the institution sets, and anyone authorized can switch it off.
Banks carry the full POCAMLA duty set plus the CBK's guideline. The draft PG 08 published in September 2026 shows where CBK expectations are heading, and several proposals change what an MLRO has to produce.
These are proposals open for comment until November 7, 2026. Even so, an MLRO who can already show a board-approved risk assessment, an assessment for each new technology and a clean STR decision trail will have little to change when the final guideline lands.
Payment service providers are financial institutions under POCAMLA because they transfer funds or value, or issue and manage means of payment such as electronic money. The CBK lists payment service providers, money remittance providers and digital credit providers among the institutions it supervises for POCAMLA compliance. The duties in the sections above apply in full: registration, risk assessment, due diligence, seven-year records, two-day STRs and CTRs.
Mobile payment providers also have the CBK's 2013 anti-money laundering guidelines for mobile payment services. They require clear accountability for the actions of agents through agent agreements. They require records to be stored for a minimum of seven years from the date of transaction, so that there is an audit trail. They also describe a "nominated officer", an AML compliance officer appointed by the mobile payment service provider. The 2023 Regulations now require every reporting institution to appoint an MLRO, with the management-level and independence requirements described above.
Agents are where most of the practical risk sits. The provider stays accountable for what an agent does, so agent onboarding, agent monitoring and the agent agreement belong in the provider's own risk assessment and evidence pack.
Two changes are coming. The draft National Payment System Bill, 2026 intends to repeal the current National Payment System Act. Any provider that also touches virtual assets now needs a licence under the Virtual Asset Service Providers Act, 2025, from the CBK or the Capital Markets Authority as the relevant regulatory authority.
Illustrative scenario, not a customer result.
A Nairobi bank has a corporate customer, a hardware wholesaler. On a Tuesday, the wholesaler deposits cash worth more than USD 15,000 at one branch. Over the same fortnight, the bank's mobile banking channel shows many small transfers into the wholesaler's account from wallets that were funded at the same few agent outlets.
The deposit crosses USD 15,000, so the bank files a CTR with the FRC by Friday, suspicious or not. Whether the agent pattern is suspicious is a different question, and only the MLRO can answer it.
Sanctions screening in Kenya runs on a 24-hour clock, and the freeze report goes to a committee through the FRC.
The FRC's targeted financial sanctions guidance, first issued on 6 March 2025 and revised on 7 July 2025, defines "without delay" as within twenty-four hours of a designation by the UN Security Council or its relevant sanctions committee, or of a designation by the Committee. Reporting institutions should report any funds or assets frozen, or any other action taken under the prohibitions, including attempted transactions, within 24 hours to the Committee, through its Secretary, the FRC.
Your screening lists need to include the Domestic List. That list is made up of persons and entities designated by the Counter Financing of Terrorism Inter-Ministerial Committee for involvement in terrorism and terrorism financing, under UN Security Council Resolution 1373. It sits alongside the UN sanctions lists. Your screening has to pick up updates to both, and freeze within 24 hours of a designation.
Two-day STR duty (s.44), CDD and beneficial owner (s.45), higher-risk countries (s.45A), seven-year records (s.46), MLRO reporting (s.47), FRC registration (s.47A), civil penalties (s.24B), USD 15,000 CTR threshold (Fourth Schedule).
Kenyan statute as revised to 2023; FRC-hosted copy.
2026-10-14
Risk assessment (reg. 7), new technologies (8), MLRO (12), STR within two days (38), CTR by Friday (40).
Kenya Gazette Supplement No. 181, October 6, 2023.
2026-10-14
CBK's supervisory mandate over banks, PSPs, remittance and digital credit providers; Banking Act guideline.
CBK official page.
2026-10-14
Proposed annual risk assessment submission, board-level MLRO reporting, 48-hour STRs, new-technology assessments; comments due November 7, 2026.
Consultation draft, not in force.
2026-10-14
24-hour sanctions freeze and report, Domestic List (TFS guidance, revised July 7, 2025); seven-day STR wording in the May 2025 STR guidance, which conflicts with the Act; High Risk Jurisdictions Circular No. 1 of 2026 listing Kenya.
FRC guidance, not legislation.
2026-10-14
Assent 15 October 2025, commencement 4 November 2025, CMA and CBK as regulatory authorities, licensing requirement.
Kenyan statute; Kenya Law.
2026-10-14
| Metric | Definition | Decision guardrail |
|---|---|---|
| STR timeliness | Share of STRs filed within two days of the recorded suspicion. | Measured from the suspicion date, not the review date. |
| CTR completeness | Share of qualifying cash transactions reported by Friday. | Reconciled against the cash ledger, not the alert queue. |
| Decision record | Share of MLRO escalations with a written decision and reason. | Every decision not to report keeps its reason on file. |
| Beneficial owner completion | Share of corporate customers with the beneficial owner verified from a reliable source. | An untraced chain stays open with the reason recorded. |
| Policy-to-control coverage | Share of policy clauses mapped to a live, tested control. | A clause with no control is reported as a gap, not hidden. |
A Kenyan AML program is judged as one chain. The board-approved risk assessment sets the policy, the policy sets what goes into each customer file, and the customer file has to explain every STR, every CTR, every freeze and every decision not to report. The 2023 changes moved the working detail into the Regulations and set the two-day STR clock and the USD 15,000 cash threshold. The CBK's 2026 drafts point to annual risk assessment submissions and an MLRO who reports to the board. An inspector checks whether the MLRO's decisions, and the date each suspicion arose, are written down and can be traced back.
For the wider program elements an inspector tests, see our guide to AML compliance and how teams automate it, and use our AML program charter template to set out the board, management and MLRO roles. If your team is deciding how much of the reporting work to automate, our regulatory reporting page shows how agents draft STRs and CTRs while your MLRO approves every filing.
The Financial Reporting Centre is Kenya's financial intelligence unit, established under section 21 of POCAMLA. Reporting institutions register with it and send it suspicious transaction reports, cash transaction reports and sanctions freeze reports.
Two days after the suspicion arose, under section 44(2) of the Act and Regulation 38. Some older guidance still mentions seven days, and the CBK's 2026 draft for banks proposes 48 hours, but the Act and the 2023 Regulations set the two-day limit.
USD 15,000 or its equivalent in any other currency, for cash transactions, whether or not they look suspicious. The report is due by the Friday of the week in which the transaction occurred.
A person at management level with the competence, authority and independence the role needs. An internal auditor or chief executive can't hold the role, except a chief executive who is a sole proprietor, and appointments and removals must be notified within fourteen days.
The core POCAMLA duties are the same, because the Act treats any business that transfers funds or value, or issues electronic money, as a financial institution. The CBK supervises payment service providers, and mobile payment providers also follow the CBK's 2013 guidelines on agents and records.
The FRC's February 27, 2026 circular lists Kenya among the jurisdictions under increased monitoring after the FATF's February 2026 meeting. Check the FRC's circulars after each FATF plenary for the latest status.
Yes, provided the institution assesses the technology's risk first and the MLRO keeps the reporting decision. The 2023 Regulations require a risk assessment before any new technology is introduced, and the MLRO is the person who reports to the FRC. With FluxForce, agents prepare the case and draft the report, and the MLRO approves or rejects every filing.