POCAMLA Compliance in Kenya: The Complete 2026 Guide

How confident are you that your business could survive a POCAMLA audit, if the Financial Reporting Centre requested your records this week?

POCAMLA Kenya has governed how businesses handle customer identification, due diligence, and suspicious activity reporting since 2009, but the Act enforced today looks nothing like the one written back then. It has been amended multiple times since, most significantly through the 2025 Amendment Act, and each round has brought tighter obligations while pulling in businesses that were never covered before.

That evolution is exactly why so many compliance teams get caught off guard. A policy built around an older version of the law, or around what felt sufficient a few years ago, rarely matches what POCAMLA Kenya actually requires now. Most businesses still treat AML compliance Kenya as something they set up once and revisit only when a problem forces them to, and that habit is precisely what the current version of the Act was written to catch.
‍

What Is POCAMLA?

POCAMLA Kenya, formally the Proceeds of Crime and Anti-Money Laundering Act, criminalises money laundering in Kenya and sets out what businesses must do to stop their services being used to move illicit money. It became law in 2009, but the version enforced today is far stricter than the one originally written, shaped by several rounds of amendment and most recently by the 2025 Amendment Act, which raised penalties sharply and brought many more businesses under its scope.

Beyond the Act itself, a set of detailed regulations spells out how it works in practice. These cover how customer identity gets verified, when a transaction needs to be reported, and how long records must be kept. Anyone still working off an older understanding of POCAMLA Act Kenya is likely missing changes that now shape what compliance actually looks like.
‍

POCAMLA Requirements Kenya: Who Must Comply

POCAMLA organises reporting institutions into two categories, and neither carries lighter obligations than the other, regardless of how differently they operate day to day.

Financial institutions cover the businesses most people associate with AML law in the first place:

• Banks and microfinance institutions
• Insurance companies
• Capital markets firms and stockbrokers
• Money remittance and payment service providers
• SACCOs

Designated Non-Financial Businesses and Professions, or DNFBPs, is the second category, and it has long included:

• Lawyers and accountants
• Casinos, both land based and online
• Dealers in precious metals and stones

Real estate agencies are the newest addition to this list, formally brought under the DNFBP definition, with the Estate Agents Registration Board now empowered for AML oversight. Many agencies that never considered themselves part of a regulated sector now carry the same due diligence and reporting obligations as a bank.

Industry labels have little bearing on whether POCAMLA requirements Kenya apply to a given business. What matters is exposure. Any entity handling client funds, facilitating high value transactions, or operating close to how wealth changes hands sits within scope, whether it has historically thought of itself as regulated or not.
‍

Financial Reporting Centre Kenya (FRC): Registration and Supervision

Every reporting institution's relationship with POCAMLA runs through one body, the Financial Reporting Centre Kenya, which functions as the country's financial intelligence unit. Registration with the FRC isn't optional or informal. It happens through a dedicated online portal called goAML, and it's the first real signal to the regulator that a business understands it falls within scope and is prepared to operate accordingly.

Once registered, the relationship doesn't end there. The FRC expects reporting institutions to submit an annual compliance report by the 31st of January each year, detailing how the business has met its obligations under POCAMLA and the supporting regulations over the preceding twelve months. 

Supervision itself is sector based, meaning the FRC works alongside regulators specific to each industry, the Central Bank of Kenya for banks, the Capital Markets Authority for capital markets firms, and the Gambling Regulatory Authority for casinos, while retaining overall authority to request records, investigate gaps, and take action where something doesn't add up. For a business that treats registration as a one time formality rather than an ongoing relationship, that's usually where the trouble starts.
‍

Core POCAMLA Compliance Obligations

POCAMLA compliance in Kenya is not a single task completed during onboarding. It is a chain of obligations that runs for as long as a customer relationship exists, and each link in that chain sets up the next.

Customer due diligence and enhanced due diligence 

Every reporting institution in Kenya has to verify who its customers are and assess the risk they carry. Standard due diligence covers most customers, but enhanced due diligence Kenya rules apply where the risk is higher, including:

• Politically exposed persons and their close associates
• Customers linked to high risk or FATF grey listed jurisdictions
• High value transactions
• Customers with complex or unclear ownership structures

Suspicious and cash transaction reporting 

Once a business identifies risk, Kenyan law requires that risk to be escalated formally. 

• A suspicious transaction report Kenya (STR) must reach the Financial Reporting Centre once suspicious activity is flagged, and under the 2025 Amendment Act, delaying that report is treated as non-compliance in its own right. 
• Cash transactions carry a separate reporting duty. A cash transaction report Kenya (CTR) is required for any cash transaction equivalent to or exceeding USD 15,000, filed through goAML, regardless of whether the transaction itself appears suspicious. 

Ultimate beneficial ownership 

Reporting institutions in Kenya are also required to look past the individual in front of them and identify who ultimately owns, controls, or benefits from that customer, particularly where a company or legal structure is involved. Beneficial ownership Kenya POCAMLA requirements have tightened considerably in recent years, closing what used to be a common gap in corporate onboarding.

Record keeping 

None of the above holds up without documented proof it happened. POCAMLA record keeping obligations, set out under Regulation 37 of the Proceeds of Crime and Anti-Money Laundering Regulations, require customer identification records, due diligence notes, and transaction records to stay accurate, complete, and retrievable, with a minimum retention period of seven years.

Each obligation looks procedural on its own. Lined up together, they form the exact sequence an FRC inspection tests, and the gaps that surface are usually the ones where one step in that chain was treated as optional.
‍

POCAMLA Penalties for Non-Compliance

The financial risk of getting POCAMLA wrong is steeper than most businesses expect, and it isn't a single flat number. Under the Proceeds of Crime and Anti-Money Laundering Act, POCAMLA penalties scale with both the offence and the entity involved.

• Up to 14 years imprisonment for an individual convicted of money laundering, alongside a fine of up to KES 5 million or the value of the property involved, whichever is higher
• Up to KES 25 million, or the value of the property involved, whichever is higher, for a company convicted of the same offence
• Up to 50 percent of the amount involved as a separate penalty for failing to declare monetary instruments crossing Kenya's borders
• An additional KES 10,000 per day for continued non-compliance, capped at 180 days

A business that assumes one number covers every scenario is usually underestimating what it's actually exposed to, especially once cross-border transactions enter the picture.
‍

Kenya's FATF Grey List Status in 2026

Kenya was placed on the FATF grey list in February 2024, and it remains there as of the June 2026 plenary. Algeria and Namibia both exited that same review cycle after demonstrating sustained reform, a contrast that makes Kenya's continued listing harder to treat as a formality still working itself out in the background.

The practical consequences are already visible across how Kenyan institutions do business internationally:

• Correspondent banks apply heavier scrutiny to cross-border payments routed through Kenyan institutions
• International partners lean more heavily on enhanced due diligence before entering new relationships
• Investors factor grey list exposure directly into risk pricing before committing capital
• Approvals that once moved quickly now come with additional documentation requests, or in some cases, don't come through at all

This exposure attaches to the jurisdiction, not to any single institution's individual track record. Every business operating under Kenya FATF grey list 2026 conditions absorbs a share of that scrutiny by default, regardless of how disciplined its own compliance programme happens to be.
‍

POCAMLA Compliance Checklist

Understanding the obligations is one thing. Proving them in practice, on demand, is what actually holds up during an FRC inspection. Most gaps trace back to one of the following being treated as settled once and never revisited since.

• Registered with the Financial Reporting Centre through the goAML portal
• Documented AML/CFT policy in place, covering onboarding, CDD, and escalation procedures
• Risk-based customer due diligence process applied consistently across all customers
• Enhanced due diligence triggers clearly defined for PEPs, high-risk jurisdictions, and complex ownership structures
• Beneficial ownership identification built into onboarding for corporate and legal entity customers
• Suspicious transaction reporting process that can move quickly once risk is flagged
• Cash transaction reporting process in place for transactions at or above the USD 15,000 threshold
• Records retained for a minimum of seven years, in a format that's accurate, complete, and retrievable on request
• Staff trained on AML obligations relevant to their role, rather than a generic annual refresher
• Annual compliance report submitted to the FRC by the 31st of January deadline

The businesses that hold up under scrutiny aren't the ones with the most polished policy document. They're the ones that can produce evidence against every line above without needing a week to prepare for it.
‍

Staying Ahead of POCAMLA Compliance

POCAMLA keeps moving in one direction. More sectors get pulled in, penalties get heavier, and the bar for what counts as compliant keeps climbing. That trend shows no sign of slowing down, which means the rules businesses are working with today will likely look outdated again before long.

FlexComply, an award-winning, end-to-end compliance solution by FlexM, the leading global fintech conglomerate, gives Kenyan businesses everything they need to stay compliant, from identity verification and due diligence to transaction monitoring and regulatory reporting, so they can stay ahead of POCAMLA compliance rather than scramble to catch up every time it changes.

‍