Five East African countries have been assessed against the same FATF standard, and all five published reports are public. Read together, they tell a story the individual country headlines miss: the law on the books is improving quickly, while the evidence that any of it works is eleven years old in one case and has never been refreshed in any of them.

Every few years, a country's anti-money-laundering regime is examined by its regional FATF-style body and the result is published in full. For the five East African countries in this piece — Kenya, Uganda, Tanzania, Rwanda and Ethiopia — those reports run to thousands of pages and are freely available. They are the single best public evidence of how financial crime controls actually work in the region, and they are rarely read side by side.

This is an original reading of all five, together with every published follow-up report. Everything below is drawn from those documents. Where a figure is our own count of a published rating table, we say so; where we could not verify something, we have left it out rather than estimate it.

Two scorecards, and why the difference is the whole story

A mutual evaluation produces two separate verdicts, and conflating them is the most common error in commentary on this subject.

The first is technical compliance: for each of the 40 FATF Recommendations, is the country's legal and institutional framework in line with the standard? Each Recommendation is rated Compliant, Largely Compliant, Partially Compliant or Non-Compliant. This measures the law on the books.

The second is effectiveness: for each of 11 Immediate Outcomes — supervision, preventive measures, financial intelligence, investigation and prosecution, confiscation, terrorist-financing and proliferation-financing sanctions, and so on — is the country actually achieving the result the standard is for? Each is rated High, Substantial, Moderate or Low. This measures whether any of it works.

A country can pass the first and fail the second, and in this region that is exactly what is happening. Crucially, the two are also refreshed on completely different cycles: technical compliance is re-rated repeatedly through follow-up reports, sometimes annually. Effectiveness is normally only re-assessed at the next full evaluation, years later.

The finding: 48 of 55 effectiveness ratings are Low

Across the five evaluations, the assessors awarded 55 Immediate Outcome ratings in total. Our count of the five published rating tables:

  • 48 rated Low
  • 7 rated Moderate
  • none rated Substantial, and none rated High

Four outcomes were rated Low in all five countries, without exception — twenty ratings out of twenty:

| Immediate Outcome | Kenya | Uganda | Tanzania | Rwanda | Ethiopia | |---|---|---|---|---|---| | IO.3 — supervision | Low | Low | Low | Low | Low | | IO.4 — preventive measures | Low | Low | Low | Low | Low | | IO.7 — ML investigation and prosecution | Low | Low | Low | Low | Low | | IO.11 — proliferation-financing sanctions | Low | Low | Low | Low | Low |

The seven Moderate ratings are scattered and worth naming precisely, because they are the only bright spots in the set: Kenya and Tanzania each earned Moderate on IO.2 (international co-operation) and IO.8 (confiscation); Ethiopia on IO.2 and IO.5 (legal persons); and Rwanda on IO.6 (financial intelligence) — the only country in the five whose single above-Low rating is for the use of financial intelligence. Uganda was rated Low on all eleven.

Technical compliance, meanwhile, has moved a great deal

Set the effectiveness picture against what the follow-up reports show. Countries have been re-rated on the 40 Recommendations repeatedly since their evaluations, and the improvement is real and substantial.

| | Kenya | Uganda | Tanzania | Rwanda | Ethiopia | |---|---|---|---|---|---| | Evaluation | Sept 2022 | April 2016 | June 2021 | July 2024 | May 2015 | | On-site visit | Jan–Feb 2022 | June 2015 | July 2019 | Jun–Jul 2023 | April 2014 | | At evaluation (C / LC / PC / NC) | 2 / 1 / 26 / 11 | 4 / 1 / 14 / 21 | 3 / 11 / 17 / 9 | 5 / 14 / 20 / 1 | 8 / 17 / 10 / 4 | | Latest follow-up | Aug 2024 | March 2026 | Sept 2024 | Aug 2025 | April 2022 | | Now (C / LC / PC / NC) | 19 / 9 / 10 / 2 | 18 / 13 / 7 / 2 | 10 / 15 / 13 / 2 | 7 / 17 / 15 / 1 | 11 / 25 / 3 / 0 | | Still Non-Compliant | R.8, R.15 | R.25, R.39 | R.8, R.28 | R.8 | none |

Kenya's shift is the most dramatic: from 2 Compliant and 37 Recommendations rated only Partially or Non-Compliant at evaluation, to 19 Compliant and just 2 Non-Compliant two years later. Uganda, starting from the weakest base of the five — 21 Non-Compliant in 2016 — now has 18 Compliant and 2 Non-Compliant. Ethiopia has no Non-Compliant ratings at all.

Read on its own, that table looks like a region that has largely fixed its problem.

But effectiveness has not been re-assessed anywhere

Here is the gap. In none of the five countries has effectiveness been re-assessed since the original evaluation. The follow-up reports cover technical compliance only, and they say so plainly. Kenya's third follow-up report states: "The report does not cover the progress made by the Republic of Kenya in improving its effectiveness."

So the newest public evidence on whether these regimes actually work dates from:

  • Rwanda — 2024 (on-site 2023)
  • Kenya — 2022 (on-site early 2022)
  • Tanzania — 2021 (on-site 2019)
  • Uganda — 2016 (on-site 2015)
  • Ethiopia — 2015 (on-site 2014)

Ethiopia is the sharpest illustration. It now has the cleanest technical-compliance profile of the five, with no Non-Compliant ratings — and its effectiveness ratings, nine of eleven Low, were awarded on the basis of a visit in April 2014. Twelve years of practice sit unexamined between the two numbers. The next evaluations are scheduled well ahead: Uganda in 2028, Tanzania in 2030, Rwanda in 2029, Kenya in 2031.

Nothing about this is a criticism of the assessors; it is simply how the cycle is built. But it means a reader who cites a rising technical-compliance score as evidence that financial crime controls are working has mistaken one scorecard for the other.

What the assessors actually said

Reading the five reports together, the same findings recur in almost identical language. These are the patterns, with the countries they appear in.

1. Supervision is not risk-based, and non-financial businesses are barely supervised at all. Every one of the five. Kenya's report: "Financial sector supervisors are not implementing risk-based supervision as the supervisory actions are not based on risk profile of the institutions… Across the DNFBPs, a significant concern is that AML/CFT supervision is non-existent." Tanzania's: supervisors "have not yet adopted and started implementing AML/CFT risk-based supervision. The majority of the DNFBPs do not have designated AML/CFT supervisors." Rwanda's: supervisory activities "are not conducted on a risk sensitive basis", and virtual-asset service providers "are neither regulated nor supervised". Ethiopia's: "So far only supervision of the banking sector."

2. Supervision checks that controls exist, not that they work. Kenya's assessors put it most directly: inspections "focus on the presence of basic controls rather than the soundness of AML/CFT programs", and because supervisors "apply rule-based supervision, the main focus seems to be on the existence of controls rather than on the soundness of the AML/CFT framework". Rwanda's report recommends supervisors "develop and implement monitoring tools for ensuring that remedial actions and sanctions are complied with and are positively changing compliance behaviour" — which is a polite way of saying nobody checks whether the fix stuck.

3. Targeted financial sanctions are not implemented without delay, and proliferation-financing sanctions are barely implemented at all. IO.11 was Low in all five. Kenya's assessors found implementation took "on average four days" against a standard requiring it without delay, and that in the absence of a framework for the relevant UN resolutions "there is no effective implementation" for proliferation financing, with "competent authorities do not monitor compliance". Tanzania: "no legal framework and coordination framework in place to implement UNSCRs related to PF." Rwanda: the framework "does not provide for the obligations to be implemented without delay." Ethiopia: "Delays in transmissions of designations to financial institutions", and no transmission at all to non-financial businesses.

4. Beneficial ownership is recorded but not verified, and the risk was never assessed. All five. Kenya: beneficial ownership requirements "are adhered to only to some extent and a major impediment exists in verifying BO information", companies must now file a register but "not all companies have filed such copies", and "the ML/TF risk associated with the different types of legal persons has not been assessed". Tanzania: the framework to obtain and maintain it "is inadequate", and international co-operation is "undermined by lack of information in relation to BO". Rwanda: "limited understanding of the concept of BO". Uganda had no such obligation in law at the time of its evaluation, and Recommendation 25, on the ownership of trusts and similar arrangements, was still rated Non-Compliant in March 2026 — a decade later.

5. Suspicious transaction reports come from banks, and are not aimed at the actual risks. Kenya's assessors recorded "low levels of suspicious transaction reporting by some of the DNFBPs, some of which were identified as highly exposed to ML risks". Rwanda's: reporting from non-bank financial institutions and non-financial businesses "is negligible". Ethiopia's: "STR reporting not focused on areas of highest risk; lack of reporting on TF."

6. Financial intelligence is produced, and then not used. This is the most consistent operational failure in the set, and the one least visible from outside. Kenya: "the rest of competent authorities do not routinely use financial intelligence to support their ongoing investigations… There have not been successful ML prosecutions, TF investigations and prosecutions arising from financial intelligence." Tanzania: the reports "are being underutilized in the ML/TF investigation and prosecution value chain, and also by supervisory bodies." Rwanda: "the LEAs do not routinely access and use this financial intelligence, resulting in low ML investigations." Ethiopia: "the FIC is not used as a source of intelligence by investigation authorities."

7. Virtual assets are unassessed, unregulated and unsupervised. Recommendation 15 remains Partially or Non-Compliant in all five: Non-Compliant in Kenya as at its 2024 re-rating, and Partially Compliant in Uganda (2026), Tanzania and Rwanda (2025) and Ethiopia (2022).

8. Money laundering itself is rarely prosecuted. IO.7 was Low in all five. Uganda's assessors stated flatly that "no prosecutions or confiscations have been done on the offence of ML."

Kenya's position is the one with a live, externally-set workplan attached. When the European Commission added Kenya to its own list of high-risk third countries in June 2025, it set out Kenya's FATF action plan in full — and it reads as a near-exact echo of its 2022 evaluation: improve risk-based supervision of financial institutions and non-financial businesses, license and supervise virtual-asset service providers, increase STR filing, "implement TFS without delay", designate an authority to collect accurate beneficial ownership information, improve "the use and quality of financial intelligence products", and increase money-laundering investigations and prosecutions in line with risk. Kenya was added to the FATF's list of jurisdictions under increased monitoring in February 2024. Uganda was removed from that list in February 2024, and Tanzania with effect from 13 June 2025.

What this means if you build or run the systems

Six of the eight patterns above are not policy problems. They are systems problems, and they are the same six everywhere:

  • Sanctions screening has to act, not just alert. "Without delay" is a system property — how fast a new designation reaches the screening engine, and whether a payment can complete before it does. A four-day implementation window is an architecture outcome, not a staffing one.
  • Supervision will increasingly ask whether controls work. The evidence that they do is a reproducible decision: the data as it stood, the list version screened against, the rule version in force, and the audit record tying them together. A system that overwrites its inputs cannot produce that evidence at all.
  • Beneficial ownership needs verification, not collection. Every one of the five assessments distinguishes holding the data from being able to confirm it — and it is the confirmation step that systems mostly do not do.
  • The intelligence handoff is where effectiveness dies. Reports that are produced and never used is a workflow failure between institutions, and it is the single most repeated finding in the set.
  • Reporting coverage follows supervision coverage. Where nobody supervises, nobody reports; where nobody reports, risk is invisible regardless of how good the law looks.
  • Virtual assets are a standing gap in all five jurisdictions at once.

An institution operating in this region should expect the direction of travel to be the same everywhere: from "do you have a policy" towards "show me the decision, the rule that produced it, and the evidence it was applied when you say it was".

A note on the documents themselves

One finding is about the evidence rather than the regimes, and it matters for anyone citing this material.

The published reports contradict themselves in places. Tanzania's fourth follow-up report asserts that "30 out of the 40 Recommendations… were rated Partially Compliant (PC) and Non-Compliant (NC) representing 75%", while the rating table reproduced in the same document shows 26, or 65%. Uganda's March 2026 report recommends upgrading Recommendation 40 in its text, while its own ratings table records no change and prints it as Partially Compliant. Rwanda's follow-up report carries a footnote citing Botswana's evaluation, and a paragraph that lists Recommendation 12 as both upgraded and maintained. Several reports carry three different dates — the cover, the index entry on the publisher's site, and the heading of the internal results table.

None of this undermines the substance. But it means the only safe practice is to cite the rating tables, not the prose summaries, and to read the original document rather than a secondary account of it. Every figure in this piece comes from a table we read in the source PDF.

What we have not claimed

In the interest of being useful rather than complete: we have not stated the current FATF listing status of Rwanda or Ethiopia, because we could not confirm it from a primary document. We have not quoted suspicious-transaction-report volumes, supervisory enforcement counts or any other national statistic, because the national financial-intelligence-unit publications we could reach did not support them. Listing decisions are taken at FATF plenary meetings and change; the dates given above are the ones we could verify, not a statement about today.

Our free course AML Screening Foundations covers sanctions lists, PEPs, name matching and alert review, and Advanced: Assuring a Transaction Monitoring and Screening System covers testing whether the controls above actually work — both with a knowledge check and a certificate.

Sources