AML screening foundations.

Why AML exists

Anti-money laundering (AML) is the set of laws and controls that stop criminals from using the financial system. Money laundering is the process of making money from crime look as if it came from a legitimate source. Criminals do this so they can spend the proceeds of fraud, corruption, drug trafficking or other offences without drawing attention to where the money came from.

Laundering is usually described in three stages:

• Placement: getting criminal cash or funds into the financial system, for example through deposits, purchases or mobile-money transfers.
• Layering: moving the money through many transactions, accounts, products or countries so that its origin becomes hard to trace.
• Integration: bringing the money back into the legitimate economy, for example as property, business investment or apparently ordinary income.

Terrorist financing is a related but different crime. The money may come from legitimate sources, such as salaries or donations. What is hidden is what the money will be used for.

International standards against both are set by the Financial Action Task Force (FATF). It is an intergovernmental body, and countries are expected to put its Recommendations into their own laws. In Kenya, the main AML law is the Proceeds of Crime and Anti-Money Laundering Act, 2009 (amended several times since). Terrorist financing is dealt with mainly by the Prevention of Terrorism Act, 2012. The Financial Reporting Centre (FRC) is Kenya's financial intelligence unit: the national body that receives and analyses suspicious transaction reports.

Regulated institutions must follow a risk-based approach. This means they work out where their money-laundering risks are highest and put the most effort there. Screening customers and payments against sanctions lists and lists of politically exposed persons is one of the core controls.

Sanctions and watchlists

Sanctions are legal restrictions placed on named people, organisations, vessels or countries. They can include asset freezes, bans on making funds available, travel bans and trade restrictions. An institution that deals with a sanctioned party can face heavy penalties. It must therefore check its customers and payments against the lists that apply to it.

Widely used lists include:

• the United Nations Security Council Consolidated List, which all UN member states must implement. In Kenya, UN terrorism-related designations are given effect through the Prevention of Terrorism Act, 2012 and regulations made under it;
• the Specially Designated Nationals and Blocked Persons (SDN) List, published by the US Office of Foreign Assets Control (OFAC);
• the European Union consolidated list of persons and entities subject to financial sanctions;
• the UK Sanctions List, published by the UK Foreign, Commonwealth & Development Office. Since 28 January 2026 it has been the only official source of UK sanctions designations; the older OFSI Consolidated List is no longer updated.

Which lists an institution must screen against depends on where it operates, the currencies it uses and who it deals with. For example, a Kenyan bank that sends US dollar payments will usually screen against the OFAC list as well as the UN list. That decision belongs to the compliance function and legal advisers.

Lists change often: names are added, details are corrected and people are removed. Good screening therefore needs two habits:

• always screen against the current version of each list;
• re-screen existing customers whenever the lists change, not only when they first join.

Politically exposed persons

A politically exposed person (PEP) is someone who holds, or has held, a prominent public function. Examples include a head of state, a cabinet secretary, a member of parliament, a county governor, a senior judge, a senior military officer or a senior executive of a state-owned company. Middle-ranking and junior officials are not normally PEPs. FATF standards separate foreign PEPs, domestic PEPs and people with prominent functions in international organisations.

The same standards extend to a PEP's family members and close associates, because they can be used to hold or move money for the PEP.

Being a PEP is not a crime and not an accusation. It means the person's position could expose them to bribery or corruption. Under the FATF standards:

• enhanced due diligence (EDD), meaning extra checks, is always required for foreign PEPs;
• for domestic PEPs and international-organisation PEPs, EDD is required when the relationship is assessed as higher risk.

Typical EDD measures include:

• establishing the source of wealth (how the person built their overall wealth) and the source of funds (where the money for this account or payment comes from);
• getting senior management approval for the relationship;
• monitoring the relationship more closely over time.

A PEP match is handled differently from a sanctions match. A sanctions match can require funds to be frozen. A PEP match usually means extra checks, not refusal. When someone leaves office, they do not automatically stop being treated as a PEP. How long the extra checks continue should be decided on risk, not by a fixed date.

Why name matching is hard

Screening compares a name, such as a new customer or the person receiving a payment, with the names on the lists. Matching only identical names fails, because one person's name can be written in many ways:

• spelling variants, such as Mohammed, Muhammad and Mohamed;
• transliteration from other scripts, such as Arabic, Cyrillic or Chinese, where there is more than one accepted way to write a name in Latin letters;
• name order, such as "Wanjiku Kamau" and "Kamau Wanjiku", plus missing middle names, initials and titles;
• typing errors and aliases (other names the person is known by).

Screening systems therefore use fuzzy matching, which finds names that are similar rather than identical. Common techniques include:

• edit distance: how many single-letter changes turn one name into the other (Mohamed to Mohammed is one change);
• phonetic codes: whether two names sound alike;
• token overlap: how many words two names share, in any order.

The result is a similarity score, and a threshold decides which scores become alerts. This is a trade-off. A lower threshold catches more true matches but produces more false alarms. A higher threshold produces fewer alerts but risks missing a real match. Setting it is a documented, risk-based decision.

Other details, such as date of birth, nationality and identity numbers, are what turn a possible match into a confirmed one, or rule it out.

Reviewing alerts well

Most screening alerts are false positives: a customer who happens to share a name with a listed person. Reviewing them well is much of the daily work of a screening team.

• Compare identifiers, not just names: date of birth, nationality, address, identity numbers and any other details on the listing.
• Record your reasoning. An auditor or regulator may ask, months later, why you cleared or confirmed an alert. A decision with no written reason is hard to defend.
• Use a second reviewer for high-risk decisions (often called the four-eyes principle), so no single person can clear or confirm a serious match alone.
• Escalate true or likely matches following your organisation's procedures and the law. That can mean freezing funds and reporting to the relevant authority.
• Do not tip off the customer. In Kenya, section 8 of the Proceeds of Crime and Anti-Money Laundering Act makes it an offence to tell anyone that a suspicious transaction report is being prepared or has been sent to the FRC.

Screening teams also measure how well screening works. Precision is the share of alerts that turn out to be real matches. Recall is the share of real matches that the system actually catches. Improving one often lowers the other, which is why thresholds are tested and reviewed regularly rather than set once.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.