Africa compliance, country by country.

A reporting institution should identify and verify the customer from reliable independent sources, identify and reasonably verify the beneficial owner, understand the purpose and intended nature of the relationship, and conduct ongoing due diligence. The exact data and evidence depend on customer type and risk.

The 2023 Regulations address evidence of registration or incorporation, governing documents, registered and principal business addresses, transaction authority, details of natural persons who manage, control or own the entity, beneficial-owner information and financial statements, subject to the applicable circumstances and exceptions.

The 2023 Regulations require reporting institutions to retain transaction records and CDD-related records for a minimum of seven years from completion of the transaction or termination of the account or business relationship.

Section 44(2)-(3) of POCAMLA and regulation 38 of the 2023 Regulations require suspicious transactions or activities, including attempted transactions, to be reported to the Financial Reporting Centre within two days after the suspicion arose. The legislation does not describe these as working days, and supporting information and directly relevant documentation should accompany the report.

No. Kenya remained under increased monitoring as of 19 June 2026, but FATF does not call for automatic enhanced due diligence or wholesale de-risking solely because a jurisdiction is listed. Apply a proportionate risk-based approach and current Kenyan high-risk-country requirements.