KYC.IO

Global Regulations and Requirements for KYC Onboarding
(powered by KYC-Chain)

KYC to onboard domestic persons

passportbirth certificatedriving licenseidentity cardsource of incomebank refereeutility bill

KYC to onboard international persons

passportbirth certificatedriving licenseidentity cardsource of incomebank refereeutility bill

corporate requirements

certificate of registrationcertificate of incorporationPartnership DeedMemorandum&Articles of AssociationBoard Resolutionaddress of chairman, managing director, or general partneraudited financial statements

National ID card name

national Identity Cards

National ID Photo

Does the country have Esignature Laws?

Kenya Information and Communications Revised Edition 2012 [1998].pdf

E-sig law files

What year did the relevant AML laws and regulations become effective?

2010

Further details on AML regime

2010. The Proceeds of Crime and Anti-Money Laundering Act 2009 (“POCAMLA”) was enacted on 11 Dec 2009, and came into effect on 28 Jun 2010.

Who is the regulator for AML controls for Banking

the Financial Reporting Centre (“FRC”) is designated as the competent authority for supervising financial institutions for compliance with AML obligations. The FRC became operational in Apr 2012.

Link to site

http://frc.go.ke/

Other financial Services

the Capital Markets Authority (“CMA”) regulates AML controls for listed entities and entities licenced by the CMA; the Central Bank of Kenya regulates banks in Kenya and the Insurance Regulatory

Website of Regulator

N/A

Financial Sector regulator

N/A

Practical Guidance for AML

Yes. The Central Bank of Kenya issued a Guideline on Proceeds of Crime and Money Laundering Prevention which became effective on 01 Jan 2006. The Central Bank also issued Foreign Exchange Bureau Guidelines which in part addresses AML requirements, which became effective on 01 Jan 2007; The FRC is empowered to develop regulations on anti-money laundering and to provide guidance to support the implementation of POCAMLA. The FRC website also includes guidance on AML issues; The Insurance Regulatory Authority issued guidelines to the insurance industry on implementation of POCAMLA in Jun 2011. The purpose of the guidelines is to provide guidance on detection, deterrence and reporting incidences of possible crimes related to proceeds of crime and money laundering by the insurance industry; and The Capital Markets Authority (“CMA”) on 01 Oct 2015 issued a guideline on AML and combating financing of terrorism in the capital markets.

Practical guidance PDF's

www.centralbank.go.ke

Is there a requirement to verify the identity of customers retroactively?

No.

Retroactive details

No.

Has the country been the subject of FATF mutal evaluation in the last 3 years?

A Mutual Evaluation Report on Kenya was undertaken by the Eastern and Southern Africa Anti-Money Laundering Group (“ESAAMLG”) and published in Sept 2011.

PDF of FATF review

Are there minimum transaction thresholds (Y/N)

Yes

More details on minimum transaction thresholds.

Yes, for telegraphic transfers and travellers cheques. A foreign exchange bureau should not sell foreign currency or travellers cheques in excess or equal to the equivalent of USD10,000 per customer per day without seeing and recording a valid identification document.

What are the requirements for customer identification information for individuals

Individuals: a) an official record such as passport, birth certificate, identity card or driving licence; b) address verified by a referee or utility bill; c) source of income; and d) written confirmation from the customer’s previous bank attesting to their identity and account relationship history (bank referee).

Details to be Collected on Corporates

Corporates / Firms: a) Certificate of Registration, Certificate of Incorporation, Partnership Deed, Memorandum and Articles of Association; b) Board Resolution stating authority to open accounts and designating persons having signatory authority; c) identity the address of the chairman, managing director, or the general partner and at least one limited partner for partnerships, or the principal owner for sole traders; d) audited financial statements for corporations; and e) where applicable, references from the customer's previous bank

What are the high level requirements around beneficial ownership (identification and verification)?

Local guidance requires institutions to have full disclosure of beneficial owners or controlling persons behind nominee accounts.

What circumstances are enhanced customer due diligence measures required?

Under the POCAMLA regulations, enhanced due diligence measures are required with respect to persons and business relations and transactions carrying a high risker and with persons established in jurisdictions that do not have adequate systems in place to combat money laundering. Under the CMA guidelines, enhanced due diligence is required where: a) a customer is a politically exposed person; b) there is a complex relationship, including use of corporate structures, with no legitimate commercial rationale; c) undue secrecy/ use of numbered accounts fin a transaction; d) involvement in cash intensive business; e) high risk nature, scope and location of business activities; and f) origin of wealth is unverifiable.

How should FI's deal with Politically exposed persons

Under the POCAMLA subsidiary regulations 2013, additional due diligence procedures required for PEPs are as follows: a) obtain approval from senior management to transact or establish the relationship with that person; b) take adequate measures to establish the source of wealth and the source of funds which are involved in the proposed business relationship or transaction; c) obtain information on the immediate family members or close associates of the person who may have transaction authority over the account; d) determine the purpose of the transaction or account and the expected volume and nature of account activity; e) review public sources of information on the politically exposed person; and f) once the account has been established, conduct enhanced ongoing monitoring of the relationship.

What enhanced due diligence must be performed for correspondent banking relationships?

According to POCAMLA Regulations 2013 Section 24, a financial institution intending to establish a correspondent financial relationship either as the correspondent financial institution or the respondent financial institution shall undertake the following measures before establishing a business relationship: a) gather sufficient information about the correspondent financial institution regarding the nature of its business activities; b) determine, from available information, the reputation of the correspondent financial institution and the quality of its supervision; c) determine the quality of anti-money laundering regulation in the correspondent financial institution’s jurisdiction or country of domicile; d) assess the correspondent financial institution’s anti-money laundering controls; e) obtain approval from senior management before establishing a new correspondent financial institution relationship; f) in respect to the correspondent financial institution’s customers, be assured that it verifies the identity of its customers and conducts on-going monitoring; and g) verify the ownership and management structures of the correspondent financial institution including whether a politically exposed person has ownership or control of the financial institution.

Are relationships with banks who might be considered a 'shell' and without substance permitted?

Yes. According to POCAMLA guidelines, relationships with shell banks are specifically prohibited. Reporting institutions are prohibited from: a) opening a foreign account with a shell bank; b) permitting its accounts to be used by a shell bank; or c) enter into or continue a correspondent financial relationship with— a. a shell bank; or b. a respondent financial institution that permits its account to be used by a shell bank.

In what circumstances is additional due diligence required for non face-to-face transactions and/or relationships?

As with face-to-face verification, the procedures to check identity must ensure that a person bearing the name of the applicant exists and lives at the address provided and that the applicant is that person he claims he is. Local guidance requires the following due diligence: requesting sight of a recent utility bill, local authority tax bill, institution statement or checking a local telephone directory (for businesses). In addition, satisfactory evidence of personal identity can be obtained by a number of means, including telephone contact with the applicant on an independently verified home or business number, employer’s personnel department confirming employment by verbal confirmation on a listed number (with the customer's consent), and salary details appearing on a recent bank or building society statement.

To whom are SAR's made? (suspicious activity reports)

Financial Reporting Center ; SARs can also be made to the Central Bank of Kenya

Link to website of SAR reporting

http://www.frc.go.ke/contact-us www.centralbank.go.ke

Other Suspicious or unusual transactions obligations.

The Act requires monitoring on an ongoing basis all complex, unusual, suspicious, and large or other transactions, and upon suspicion, it should be reported accordingly. Additionally, the Act requires that reporting institutions file reports with the FRC for all cash transactions equivalent to or exceeding USD10,000 or its equivalent in any other currency carried out by it, whether or not the transaction appears to be suspicious.

Are there any de-minimis thresholds below which transactions do not need to be reported?

No.

Are there any penalties for non compliance with reporting requirements e.g. tipping off?

Yes. Section 5 of POCAMLA makes it an offence to willfully fail to report a suspicion regarding the proceeds of crime. Section 8 of POCAMLA makes tipping off an offence. Section 16 of POCAMLA provides that contravention of either section 5 or 8 is, on conviction, liable in the case of a natural person to imprisonment for a term not exceeding 7 years, or a fine not exceeding KES2.5m (approx. USD24,915), or to both and in the case of body corporate to a fine not exceeding KES10m (approx. USD99,660) or the amount of the value of the property involved in the offence, whichever is the higher.

Are there any requirements (legal or regulatory) to use automated Suspicious Transaction monitoring technology?

No.

Is there a requirement to obtain authority to proceed with a current/ongoing transaction that is identified as suspicious?

No. However, the reporting institution is required to keep all records relating to that transaction and ensure that its reporting obligations under the Act are discharged.

Does the local legislation allow transactions to be monitored outside the jurisdiction?

According to the Act, anti-money laundering measures consistent with the POCAMLA and the subsidiary regulations of POCAMLA apply to foreign subsidiaries and branches. Where the minimum requirements of the host country are less strict than those applicable in Kenya, a reporting institution is required to ensure that its branches and subsidiaries apply the requirements of the Act and these Regulations to the extent that the laws of the host country permit.

Is there a legal requirement for a bank’s external auditor/other external organisation to report on the bank’s AML systems and controls?

No.

If an external report on the bank’s AML systems and controls is required: a) how frequently must the report be provided?

N/A

To whom should the report on AML systems be submitted?

N/A

Is an AML system part of the financial statement audit?

N/A

What are the requirements for the content of this external report on a bank’s AML systems and controls? Does it require: a) sample testing of KYC files? b) sample testing of SAR reports? c) examination of risk assessments?

N/A

Data Protection Laws And Personal Data

No.

Data Protection for Corporate Data

Data protection for "sensitive Data" and additional protections.

No.

Do any restrictions on the transfer of credit reports exist?

POCAMLA prohibits the disclosure of confidential information without the written permission of the Attorney-General unless to a court of law or for the purpose of performing functions stipulated in the Act

Regulator Acronym

FRC, CMA

Year of last FATF mutual evaluation

2011

Field 67

nameaddressrecent utility billlocal authority tax billinstitution statementcontact numberverified home/business numbersalary details on bankbuilding society statement

National ID card details

are issued a national identification card at age 18.

Passport Photo

practical Guidance yes / no

Is there a risk based approach

Legal Requirement

Requirement to proceed

requirement to use automated suspicious transaction tools

Who are SARS made to?

CBK

shell banks

Yes

EDD for correspondent banking

Yes

Minimum transactions

KES 1,014,199

Min transaction USD

10000

If the AML laws and/or regulations became effective in the last 2 years, what were the requirements of the previous AML regime?

There was not a specified AML regime in existence previously. However, the 1994 Narcotic Drugs and Psychotropic Substances Control Act prohibits concealing or transferring the proceeds of drug trafficking.

Non financial sector (e.g. casinos, high value goods etc.)

the FRC is designated as the competent authority for designated non-financial businesses and professions: Casinos, real estate agencies, dealers in precious stones and metals and accountants are designated as Designated Non-Financial Businesses or Professions (“DNFBP”) under POCAMLA. Lawyers, notaries and trust and company service providers are not subject to the requirements under POCAMLA.

Does the country have a risk based approach?

Yes. POCAMLA subsidiary legislation 2013 requires organisations classified as reporting institutions by the Act to conduct on-going due diligence on its customers and develop risk based systems and procedures. Additionally, the CMA guidelines specify that enhanced due diligence to be carried out for customers with higher risk of money laundering and simplified due diligence for customers for lower risk customers.

Where copies of identification documentation are provided, what are the requirements around independent verification or authentication?

Independent means of verifying these details include requesting sight of a recent utility bill, local authority tax bill or institution statement (care should be taken to check that the documents offered are originals in order to guard against forged or counterfeit documents); checking a local telephone directory (for businesses); making telephone contact with the applicant on an independently verified home or business number; verifying salary details appearing on a recent bank account statement; or with the customer’s consent, calling their employer’s personnel department to confirm employment etc. Documents must be certified by suitable third parties and confirmation from the previous bank obtained where possible. Suitable third parties include advocates, notaries public, commissioners for oaths, judges, magistrates and certain government officials.

Is there case law, other constitutional law or any other laws or regulations that may impact upon the transfer of information to this jurisdiction?

No.

List of case law, constitutional law or any other laws or regulations that may impact upon the transfer of information.

No. A bank is under an obligation of secrecy under the Banking Contract regarding its customers’ affairs. This obligation is a legal obligation arising out of the contract.