Anti-Money Laundering Laws in Kenya: Compliance Guide for Financial Institutions

Money laundering threatens the integrity of Kenya's financial system and its reputation as a regional financial hub. In February 2024, the Financial Action Task Force (FATF) placed Kenya on its list of jurisdictions under increased monitoring, commonly called the "grey list". Since then, regulators have intensified supervision and enforcement. For banks, microfinance institutions, Saccos, insurers, payment service providers, investment firms and other reporting institutions, a strong anti-money laundering and counter-terrorism financing (AML/CFT) programme is now essential. This guide explains the legal framework and the core compliance obligations.

Key takeaways

The Proceeds of Crime and Anti-Money Laundering Act, 2009 (POCAMLA) is Kenya's principal AML law, supported by the Prevention of Terrorism Act, 2012 and sector regulations.
Reporting institutions must carry out customer due diligence, monitor transactions, report suspicious activity to the Financial Reporting Centre and keep records.
Suspicious transactions must be reported promptly, and in any event within the period set by law (two days after the suspicion arises).
2023 amendments widened the list of reporting institutions to include more designated non-financial businesses and professions and virtual asset service providers.
Penalties include heavy fines, imprisonment and regulatory sanctions for institutions and individual officers.

The legal and institutional framework

Law or body	Role
Proceeds of Crime and Anti-Money Laundering Act, 2009	Creates money laundering offences, reporting obligations and the Financial Reporting Centre; provides for asset recovery
Proceeds of Crime and Anti-Money Laundering Regulations	Detailed rules on customer due diligence, record keeping and reporting
Prevention of Terrorism Act, 2012	Criminalises terrorism financing and provides for freezing of terrorist assets and implementation of UN sanctions
Anti-Money Laundering and Combating of Terrorism Financing Laws (Amendment) Act, 2023	Strengthened the framework ahead of the FATF review, expanded reporting institutions and enhanced beneficial ownership rules
Financial Reporting Centre (FRC)	Kenya's financial intelligence unit; receives and analyses reports and supervises institutions without another AML supervisor
Assets Recovery Agency	Pursues civil forfeiture of proceeds of crime
Sector supervisors	The Central Bank of Kenya, Capital Markets Authority, Insurance Regulatory Authority, Sacco Societies Regulatory Authority and others supervise AML compliance in their sectors

Money laundering offences

POCAMLA makes it an offence to engage in transactions involving property that a person knows or ought reasonably to have known is the proceeds of crime, including concealing, disguising, acquiring, using or possessing such property. It is also an offence to assist another person to launder money and to fail to report suspicious activity. Importantly, the "ought reasonably to have known" standard means that wilful blindness is not a defence.

Core compliance obligations for financial institutions

1. Risk assessment

Institutions must identify and assess the money laundering and terrorism financing risks they face, considering their customers, products, delivery channels and geographic exposure. The assessment should reflect Kenya's National Risk Assessment and be approved by the board.

2. Customer due diligence (KYC)

Verify the identity of customers using reliable, independent documents before establishing a relationship or carrying out a transaction.
Identify and verify beneficial owners of legal entities and arrangements, the natural persons who ultimately own or control them.
Understand the purpose and intended nature of the business relationship.
Apply enhanced due diligence to higher-risk customers, including politically exposed persons (PEPs), customers from high-risk jurisdictions and complex structures.
Keep customer information up to date throughout the relationship.

3. Ongoing monitoring

Transactions must be monitored to ensure they are consistent with what the institution knows about the customer. Automated monitoring systems should be calibrated to the institution's risk profile, and alerts must be reviewed and documented.

4. Reporting to the Financial Reporting Centre

Suspicious transaction reports (STRs): must be filed when an institution suspects that a transaction or activity involves proceeds of crime or terrorism financing, within the statutory timeline of two days after the suspicion arises.
Cash transaction reports: cash transactions above the prescribed threshold (USD 15,000 or its equivalent) must be reported.
Tipping off: it is an offence to disclose to a customer or third party that a report has been or will be made.

5. Record keeping

Customer identification records and transaction records must be kept for at least seven years and be available to the FRC and supervisors on request.

6. Internal controls and governance

Appoint a qualified money laundering reporting officer at management level.
Adopt board-approved AML/CFT policies and procedures.
Train staff regularly and screen new employees.
Commission an independent audit of the AML programme.

7. Sanctions screening

Institutions must screen customers and transactions against United Nations Security Council sanctions lists and domestic designations, and freeze assets of designated persons without delay.

Penalties for non-compliance

POCAMLA provides serious penalties. A person convicted of a money laundering offence may face imprisonment of up to 14 years, a fine of up to KES 5 million, or both, while a body corporate may be fined up to KES 25 million or the amount of the value of the property involved, whichever is higher. Failure to comply with reporting and other obligations also attracts fines and imprisonment for responsible officers. Separately, the Central Bank of Kenya and other supervisors can impose monetary penalties, restrict activities and take action against directors and senior managers.

What the FATF grey listing means for institutions

Grey listing increases scrutiny from foreign correspondent banks, investors and regulators. Kenyan institutions can expect more questions about their AML controls in cross-border relationships, closer supervision at home, and pressure to demonstrate effective, not just paper, compliance. Kenya has committed to an action plan with FATF, and the reforms that follow will continue to raise the bar for reporting institutions.

AML compliance checklist

Update your institution-wide risk assessment and have it approved by the board.
Review KYC procedures for beneficial ownership and PEP identification.
Test your transaction monitoring scenarios and alert handling.
Check that STRs are filed within the statutory time and that tipping-off controls are in place.
Confirm record-retention periods and data security.
Deliver role-specific AML training and document attendance.
Commission an independent AML audit and track remediation.

Frequently asked questions

Who is a reporting institution in Kenya?

Reporting institutions include banks, microfinance institutions, Saccos, insurers, payment service providers, forex bureaus, capital markets intermediaries and designated non-financial businesses and professions such as real estate agents, casinos, dealers in precious metals, accountants and, for specified activities, advocates. Virtual asset service providers have also been brought into scope.

Can a customer be told that a suspicious transaction report was filed?

No. Disclosing that a report has been made, or is being considered, is the offence of tipping off.

How W.O.A. Advocates can help

We advise financial institutions and fintechs on AML/CFT programme design, regulatory inspections, investigations and enforcement proceedings. Contact our banking and compliance team, and read our related guides on banking law in Kenya and cryptocurrency regulation.