KYC Compliance for Kenyan Businesses: What the Law Requires

Know Your Customer (KYC) compliance is not optional for Kenyan businesses. The Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) and the regulations issued under it impose specific obligations on a wide range of businesses, not just banks. Failure to comply carries serious penalties including fines of up to KES 5 million and criminal liability for directors. This guide explains what the law requires in plain language.

Who Does KYC Compliance Apply To?

POCAMLA designates certain categories of businesses as "reporting institutions" that are subject to the most rigorous KYC requirements. These include:

• Banks and financial institutions licensed by the Central Bank of Kenya.
• Insurance companies and brokers licensed by the IRA.
• Capital markets intermediaries licensed by the CMA.
• Savings and credit cooperatives (SACCOs).
• Money remittance providers and mobile money operators.
• Real estate agents handling property transactions above a specified threshold.
• Lawyers and accountants handling client funds or real estate transactions.
• Dealers in precious metals and stones.
• Virtual asset service providers.

Beyond this list, all businesses have basic obligations to verify the identity of their clients, particularly for cash transactions above KES 1 million or any transaction that appears suspicious regardless of amount.

The Core KYC Requirements

Customer Due Diligence (CDD)

Before entering into a business relationship with a new client, you must:

• Identify the client and verify their identity using reliable, independent documents.
• For individuals: national ID, passport, or alien ID card. Supplement with a utility bill or bank statement to verify address.
• For companies: Certificate of Incorporation, CR12 (current register of directors and shareholders), KRA PIN certificate, and ID documents for all directors and beneficial owners holding more than 25% of shares.
• Understand the nature and purpose of the business relationship.
• Conduct ongoing monitoring of the relationship to ensure transactions are consistent with your understanding of the client's business.

Enhanced Due Diligence (EDD)

Enhanced Due Diligence is required for clients who present a higher risk of money laundering or terrorism financing. This includes:

• Politically exposed persons (PEPs): current or former senior government officials, senior executives of state corporations, and their immediate family members.
• Clients from high-risk jurisdictions as designated by the Financial Action Task Force (FATF).
• Non-face-to-face business relationships where identity cannot be verified in person.
• Clients whose transaction patterns are unusual or inconsistent with their stated business.

EDD requires obtaining additional information about the client, the source of their funds, and the purpose of specific transactions. It may also require senior management approval before onboarding.

Record Keeping Requirements

All KYC records must be retained for a minimum of five years from the end of the business relationship. This includes:

• All identity verification documents.
• Records of all transactions above the applicable threshold.
• Copies of all suspicious transaction reports filed with the Financial Reporting Centre.
• Records of all risk assessments conducted on clients.

Records must be kept in a format that allows them to be retrieved quickly in response to a request from the Financial Reporting Centre, the Kenya Revenue Authority, or law enforcement.

Suspicious Transaction Reporting

If you have reason to suspect that a transaction involves money laundering, terrorism financing, or the proceeds of crime, you have a legal obligation to file a Suspicious Transaction Report (STR) with the Financial Reporting Centre (FRC) within three business days of forming that suspicion. Tipping off the client about the STR is a criminal offence.

Penalties for Non-Compliance

The Financial Reporting Centre has enforcement powers including the ability to conduct audits, issue compliance notices, and impose financial penalties. Penalties for failure to conduct customer due diligence can reach KES 5 million for companies. Individuals, including directors, can face criminal prosecution and imprisonment.

Practical Steps for Compliance

• Develop a written Anti-Money Laundering (AML) policy that covers your customer due diligence procedures, record-keeping obligations, and suspicious transaction reporting process.
• Designate a compliance officer responsible for AML/KYC obligations.
• Train all staff who interact with clients on KYC requirements and suspicious transaction indicators.
• Review your client base periodically and update KYC information, particularly for high-risk clients.
• Register with the Financial Reporting Centre if you are a reporting institution.