AML law in Kenya, POCAMLA, the FRC and FATF.

The laws

Kenya's anti-money laundering framework rests on a small number of laws. Knowing which one does what saves a lot of confusion.

• The Proceeds of Crime and Anti-Money Laundering Act, 2009 (POCAMLA) is the core. It makes money laundering a crime (sections 3, 4 and 7) and tipping off an offence (section 8), creates the Financial Reporting Centre (section 21), sets the duties of "reporting institutions" (sections 44 to 48) and provides for the recovery of criminal assets through the Assets Recovery Agency (section 53).
• The Proceeds of Crime and Anti-Money Laundering Regulations, 2023 set out the detail: risk assessments, customer due diligence, the Money Laundering Reporting Officer, reporting and record keeping. They replaced the earlier 2013 Regulations.
• The Prevention of Terrorism Act, 2012 makes terrorist financing a crime and, with regulations made under it, provides for targeted financial sanctions: freezing the funds of people and groups designated by Kenya or by the United Nations Security Council, including designations connected with weapons of mass destruction.

The framework has been strengthened several times. A 2021 amendment brought lawyers and other legal professionals into the regime. The Anti-Money Laundering and Combating of Terrorism Financing Laws (Amendment) Act, 2023 extended the laws to proliferation financing, the financing of weapons of mass destruction, and gave supervisors stronger powers to sanction institutions. Further amendments in 2025 updated the lists of supervisors and businesses covered, and the Virtual Asset Service Providers Act, 2025 brought virtual asset service providers into the regime.

Sector laws and regulators add their own rules on top. Banks, for example, also follow the Central Bank of Kenya's guidance on anti-money laundering.

Because these laws are amended often, always work from the current consolidated version, which Kenya Law publishes online.

The institutions

Several bodies share the work, each with a distinct role:

• The Financial Reporting Centre (FRC) is Kenya's financial intelligence unit, set up under POCAMLA. It receives suspicious transaction reports, cash transaction reports and other reports, analyses them and passes intelligence to the authorities that investigate. It also receives declarations of cash carried across the border. The law gives it power to supervise all reporting institutions for anti-money laundering purposes, working alongside the sector supervisors, and it issues guidance.
• Supervisory bodies, listed in POCAMLA, oversee compliance in their sectors. They are the Central Bank of Kenya, the Capital Markets Authority, the Insurance Regulatory Authority, the Retirement Benefits Authority, the Sacco Societies Regulatory Authority, the Gambling Regulatory Authority, the Estate Agents Registration Board, the Institute of Certified Public Accountants of Kenya and the Law Society of Kenya.
• The Assets Recovery Agency traces and recovers criminal property, including through civil forfeiture, in which the court acts against the property itself rather than against a person.
• Investigators and prosecutors, such as the Directorate of Criminal Investigations and the Office of the Director of Public Prosecutions, investigate and prosecute offences. The Ethics and Anti-Corruption Commission and the Kenya Revenue Authority deal with the corruption and tax crimes from which much laundered money comes.

For a reporting institution, the two relationships that matter most day to day are with the FRC, where reports go, and with its sector supervisor, which inspects it and can take action when things go wrong.

Who must comply

POCAMLA's duties fall on reporting institutions. These fall into three groups.

Financial institutions, defined by what they do rather than their name: taking deposits, lending, transferring money or value, issuing electronic money and changing currency. This covers banks, microfinance institutions, Saccos, capital markets firms, money remitters, forex bureaus and payment service providers, including mobile money. In insurance, it covers life and investment-related insurers and insurance intermediaries.

Designated non-financial businesses and professions, businesses that criminals can use to hide or move value:

• casinos, including internet casinos;
• real estate agencies;
• dealers in precious metals and precious stones, when they carry out cash transactions of US$15,000 or more;
• trust and company service providers;
• accountants, advocates, notaries and other independent legal professionals, when they prepare or carry out certain transactions for clients, such as buying and selling property, managing client money or other assets, managing bank or securities accounts, and creating or running companies and other legal entities. Lawyers need not report information covered by legal professional privilege, and may report through the Law Society of Kenya.

Virtual asset service providers, such as crypto exchanges and custodians licensed under the Virtual Asset Service Providers Act, 2025.

Coverage has widened over time and continues to change. Whether a particular business is covered depends on the current wording of POCAMLA and its schedules, so check the law or ask the FRC when in doubt.

Money laundering itself is a crime for everyone, not only reporting institutions. Anyone who knows, or ought reasonably to have known, that property comes from crime and deals with it, for example by hiding, moving, acquiring, using or possessing it, can commit an offence.

The core duties and the penalties

Every reporting institution carries a common set of duties under POCAMLA and the 2023 Regulations:

• Register with the FRC.
• Assess its risks, update the assessment at least every two years, and adopt board-approved policies, controls and procedures that match them.
• Appoint a Money Laundering Reporting Officer (MLRO) at management level, and notify the FRC and its supervisor within 14 days. The chief executive or an internal auditor cannot be the MLRO, unless the chief executive is a sole proprietor.
• Know its customers: customer due diligence, with enhanced measures where risk is higher.
• Monitor transactions on an ongoing basis.
• Screen customers and transactions against United Nations and Kenyan sanctions lists, and freeze designated persons' funds without delay.
• Report suspicious transactions and activities to the FRC within two days after the suspicion arose, and cash transactions of US$15,000 or more, whether suspicious or not.
• Not tip off: telling a customer, or anyone not authorised to know, that a report is being prepared or has been sent is an offence.
• Keep records for at least seven years.
• Train staff so they can recognise and escalate suspicions.
• Test its controls through independent audit.
• File an annual compliance report with the FRC by 31 January.

Separately, anyone carrying cash or other monetary instruments worth US$10,000 or more, or the equivalent in other currencies, into or out of Kenya, including by mail or cargo, must declare them to customs.

Penalties are serious (section 16 of POCAMLA):

• Money laundering offences (sections 3, 4 and 7): an individual faces up to 14 years in prison, a fine of up to KSh 5 million or the value of the property involved (whichever is higher), or both. A company faces a fine of up to KSh 25 million or the value of the property, whichever is higher.
• Failing in the institution's duties to monitor and report, verify customers, keep records, keep internal procedures or register (section 11): an individual faces up to seven years in prison, a fine of up to KSh 2.5 million, or both. A company faces a fine of up to KSh 10 million or the value of the property, whichever is higher.
• Tipping off (section 8) carries the same penalties as failing in the institution's duties.

The FRC can also impose administrative penalties (section 24B): up to KSh 5 million for individuals and KSh 25 million for companies, plus KSh 10,000 a day for continuing failure, for up to 180 days. Sector supervisors can impose their own sanctions. These amounts change with amendments, so check the current text.

The practical lesson: an institution does not have to take part in laundering to be punished. Failing to report, to know its customers or to keep records is itself an offence. A working compliance programme is the protection.

Kenya and the FATF

The Financial Action Task Force (FATF) sets the global anti-money laundering standards. Countries are assessed against them through mutual evaluations, which check both whether the right laws exist and whether they work in practice.

Kenya is a member of the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), one of the FATF-style regional bodies, which carries out mutual evaluations in the region. ESAAMLG's mutual evaluation of Kenya, adopted in September 2022, rated the effectiveness of the system as low in nine of the eleven areas assessed.

In February 2024, the FATF placed Kenya under increased monitoring, the list often called the "grey list". Kenya made a high-level political commitment to work with the FATF and ESAAMLG on an action plan to fix the strategic deficiencies identified. As at the FATF's June 2026 plenary, Kenya remained on the list; check the FATF website for its current status and the items that remain open.

Why it matters to every institution, not only the government:

• Cross-border business costs more. Foreign banks and partners take the listing into account, and in 2025 the European Union added Kenya to its list of high-risk countries, so EU banks and businesses must apply enhanced due diligence to transactions involving Kenya. This can slow payments and raise costs.
• Supervision tightens. Regulators increase inspections and expect evidence that controls work, not just that policies exist.
• Reputation. Investors and partners take a country's FATF status into account.

Leaving the list depends on showing that the whole system works: good reports from institutions, effective supervision, and investigations and prosecutions that follow. Each institution's compliance is part of that national result.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.