Many of us who have not been technologically ordained, have multitudinous questions about the different aspects of fintech and its associated literature. The term “API” also belongs to the unfamiliar vernacular for many, which is quite frequently used in the fintech sphere.

An essential jargon in the software world- API, short for Application Programming Interface, simply put, is the means of communication between applications or programs. API lays the groundwork for how systems interact with each other, how data is transferred from one application to another, and more.

An easy way to understand APIs is to think of them as the language of software and applications. When you feed in your credit card details to make a payment on Amazon, the Amazon application communicates with your bank application to verify your details, enabling a successful purchase. This communication is possible because of the API.

How Does an API Function?

For this transfer of information to take place, there are at least three parties required:

–    The party that makes a request or a query

–    The API that transfers this information to and fro between both parties

–    The information holder or supplier

The Steps Involved

Step 1. The requester (client) requests an application.

Step 2. The API receives and processes this user request by engaging with the supplier (external) application.

Step 3. The supplier application sends the information to the API.

Step 4. The API sends this information to the requester.

And so, the circle of communication is complete.

 APIs have been designed as the language for systems to communicate with each other for easy data transfer from different applications. This means of communication is conceptually the same as a user interface, where the interface has been designed for users (us humans) to interact with systems.

Private | Partner | Public – The 3 Types of APIs

Private APIs are designed for internal use in companies. If a company has in-house applications exclusively for their staff, they use private APIs to communicate between their internal applications. 

Example: Apple Music connecting with Apple Wallet for payments.

Partner APIs are designed for communication between different websites (or companies) that have partnered with each other to give and take access to information. 

Example: Apple Music engages with PayPal (or other online portals) for payments.

Public APIs (or Open APIs) are available for use, by anyone and everyone.
Example: Using Google Maps as addresses or location pointers on numerous websites.

Do APIs Come with Hidden Benefits?

Not only have APIs been instrumental in making information transfers between different applications easy, but they also allow more flexibility, creativity, and, more than anything, a layer of security.

With the existence of APIs, it is possible to build different types of applications for various purposes involving diverse information that can communicate with each other to produce better and more refined information or results. This enablement gives a better chance for creativity and innovation of applications, where there are no rigid restrictions.

But one of the most crucial roles of APIs has been to provide an extra cover of security of information as the information shared through APIs is restricted and systematized. The user application does not have access to the entire database of the supplier’s application, so the application can only gain access to what is supplied through the API. This restriction enables very secure transmission of information between applications, making APIs extremely valuable to us.

High-performance REST API by FlexM

REST, short for Representational State Transfer, is an architectural style for APIs that puts up some constraints and allows engagement with RESTful web services through HTTP requests for data transfer between parties.

FlexM offers high-performance REST APIs that allow better and more inclusive control to different company developers. There are end-to-end encrypted, ensuring security and safety of data transfer. FlexM APIs allow the following HTTP methods:

–         GET – To fetch the data

–         POST – To submit the data.

–         PUT – To update the data

–         PATCH – To do the partial modifications of the data

–         DELETE – To delete the data

To Conclude

The API technology has been in existence for many years now, however, it is recently that its popularity has grown exponentially with the rise in fintech services like open banking, e-Payments involving third-party apps, etc. It is the means of communication between applications of different entities that enables better transfer of data and information and eventually helps build a more secure and concrete system.

‍

Every cross-border payment your fintech processes is subject to the rules of more than one country, yet the only regulator that keeps you informed is the one that licensed you.

When one of the other countries involved updates its sanctions list or changes a rule, customers your team approved months ago can become a compliance risk overnight. Your banking partners will expect that exposure to be identified and addressed promptly, because they hold you accountable for keeping pace with the global regulatory changes fintech companies face.

Sanctions are only part of the pressure, as supervisors are also raising expectations for how compliance decisions are governed and documented, including decisions where AI plays a role. Most compliance teams were built around a single regulator's timetable, but the rules they now have to track come from every market their business reaches.

In 2026, global compliance for fintechs comes down to how quickly a compliance team can turn a rule change made anywhere into updated controls, and show partners and regulators that it has done so.
‍
‍Global Compliance for Fintechs Has No Borders

A fintech's regulatory exposure stops being purely domestic once a business customer pays an overseas supplier or a transfer is settled in a foreign currency. From that point, global compliance for fintechs has to account for rules set by authorities outside the home market, and those rules apply at specific points in the payment chain:

• Customer counterparties: A business customer based in the home market may pay suppliers or receive funds from buyers in other countries. Onboarding checks cover the customer rather than those counterparties, yet a sanctioned party on either side of a payment creates exposure for the fintech processing it.
• Intermediary banks: Most fintechs without a banking licence rely on banks to move money abroad, and a single cross-border payment can pass through several banks in different countries before it reaches the recipient. Each of those banks screens the payment against the sanctions lists its own country requires it to apply, so a transfer that clears the fintech's screening can still be frozen or rejected by any one of them.
• Payment data requirements: Cross-border wire transfers have to carry the names and account numbers of both the sender and the recipient. A bank that receives a transfer with those details missing or incomplete can hold it until the information is supplied or return it, which delays the payment for the fintech's customer.

The rules enforced by a fintech's home regulator are shaped internationally as well. FATF sets the global anti-money laundering standards that national regulators build their requirements on, and its network covers more than 200 jurisdictions and observers. When FATF strengthens a standard, countries in that network are expected to bring their domestic rules in line. In June 2026, FATF approved a public consultation on payment transparency guidance to support its strengthened Recommendation 16, which sets those payment data requirements.

The practical requirement is therefore not to treat cross-border compliance as a collection of separate country checklists. It is to maintain a clear regulatory map of the business, its customers, payment corridors, counterparties and banking relationships, then connect changes in those jurisdictions to the controls they can affect.

That is the foundation of global compliance for fintechs: knowing where regulatory exposure actually travels, rather than assuming it stops at the border of the licence.
‍

Global Regulatory Changes Fintech Teams Face

A compliance programme built around one rulebook works until another country changes its own. Several global regulatory changes fintech teams have tracked since August 2026 carry implications well beyond the markets where they were announced.
‍

US Sanctions Reach Beyond US Borders

On 24 August 2026, the US Treasury issued determinations covering five sectors of Iran's economy: digital assets, technology, gold, aviation and shipping. Under those determinations, OFAC can sanction any person operating in one of those sectors, wherever that person is located.

The same action added close to 60 entities, individuals and vessels to the US sanctions list. Many of the companies named are shipping, trading and logistics businesses registered in Singapore, the UAE, Hong Kong and Switzerland rather than in Iran. Sanctions exposure therefore sits with any fintech holding an account for one of those companies or processing payments involving them, even where no transaction has ever touched Iran.

For cross-border compliance, the task after an action of this scale is establishing whether anyone in the existing customer base, or any counterparty they pay, now appears on an updated list. A team that screens customers at onboarding and again at scheduled reviews will not have that answer until the next review cycle reaches those accounts.

Running name screening and ongoing monitoring continuously closes that gap, because customers are re-checked as lists are updated and a match reaches the compliance team the same day. For sanctions exposure, that is what real-time compliance delivers.
‍

EBA Raises the Governance Bar

On 26 August 2026, the European Banking Authority opened a consultation on draft technical standards for operational risk management, which stays open until 31 December 2026. The standards set out what an institution must have in place:

• Governance arrangements that state who is responsible for managing operational risk
• A defined management process for identifying, assessing and monitoring that risk
• An assessment system supported by risk data, reporting, validation and audit requirements

The requirement applies to institutions covered by EU capital requirements legislation. A fintech with European banking partners, EU customers or payment flows into the region will be required to meet these expectations indirectly, through the due diligence those partners carry out and the terms they set.

Answering that scrutiny is where manual compliance operations come under strain. A partner bank reviewing your programme asks how a specific case was assessed, by whom and on what basis, and that evidence has to be produced from the records the team kept at the time.

Regulatory compliance automation makes those records a by-product of the work. Investigations, approvals and escalations handled through compliance case management follow a defined workflow, route higher-risk matters for senior review, and retain the full history of each case for whoever needs to examine it later.
‍

Hong Kong Tests Agentic AI Oversight

On 27 August 2026, Hong Kong's financial regulators named the first cohort of the GenA.I. Sandbox++, a supervised testing programme for agentic AI across end-to-end processes such as customer onboarding and payments. Part of the testing examines how AI can monitor the actions taken by other AI applications.

Singapore is moving in the same direction of cross-border compliance. In March 2026, MAS published an AI risk management toolkit for financial institutions, covering governance, risk assessment and lifecycle controls for traditional, generative and agentic AI.

Across APAC, supervisors are applying the same set of conditions to AI in financial services: transparency over how a system reaches its output, governance over who is accountable for it, and traceability of the decisions it supports. Fintechs using AI anywhere near onboarding, screening or payment decisions should expect those questions from regulators and banking partners alike.

Adverse media screening is where compliance teams feel this most directly, because an analyst has to judge whether an article concerns the right person, what the allegation involves and how it affects the customer's risk rating.

AML compliance automation stands up to scrutiny when the AI behind that review can be examined. AI adverse media capabilities that provide contextual analysis, explainable findings, traceable review records, continuous monitoring and audit-ready evidence trails give the team a documented basis for every decision.
‍

The Cost of Slow Cross-Border Compliance

Regulators do not penalise fintechs for missing a foreign announcement. They penalise the control failures that follow it, and the enforcement record from 2026 shows how ordinary those failures look on paper:

• Policies that were never updated: A Canadian retailer regulated as a dealer in precious metals was penalised in March 2026 for failing to keep written compliance policies up to date and failing to assess and document its money laundering risk.
• Reports that were never filed: An Edmonton money services business was fined CAD 693,742.50 after repeatedly failing to submit suspicious transaction reports where there were reasonable grounds to file them.
• A licence withdrawn: MAS revoked the Major Payment Institution licence of a Singapore payments firm in May 2026 after finding significant weaknesses in its risk management practices and failures against outsourcing guidelines.

Each of those findings points to a control that stopped matching the obligation it was built for. Policies age against current requirements, filings slip while cases wait in a queue, and processes designed for a smaller operation carry on unchanged as volumes rise. The global regulatory changes fintech businesses absorb through the year put steady pressure on all three.

The financial penalty is rarely the heaviest cost. Banking partners review enforcement notices before renewing agreements, regulators in other markets take them into account when assessing licence applications, and the remediation that follows falls to the same compliance team that was already short of time. Weak cross-border compliance limits a fintech's growth well before it results in a fine.
‍

Real-Time Compliance Is the New Baseline

Sanctions rules leave little room for delay. OFAC can impose civil penalties on a strict liability basis, which means a firm can be held liable for a prohibited transaction even where it did not know the counterparty was sanctioned. The same guidance confirms that entities owned 50 percent or more by blocked persons are themselves blocked, whether or not they appear on any list by name.

Reporting obligations work to fixed clocks as well. Suspicious activity reports, large transaction reports and cross-border transfer filings all carry deadlines counted in days, and those deadlines run from the transaction rather than from the moment an analyst opens the case.

Against requirements of that kind, global compliance for fintechs built on periodic reviews leaves obvious openings:

• A customer screened at onboarding stays unexamined until the next scheduled review, which for lower-risk accounts can be a year or more away
• Ownership changes that bring a counterparty within the scope of a sanctions designation go unnoticed between review dates
• Alerts raised late in a reporting window compress the time available to investigate and file

Real-time compliance closes those openings by tying compliance activity to events rather than dates. Screening runs again when a list changes, monitoring reacts when customer behaviour shifts, and reviews are triggered when risk moves rather than when a calendar entry falls due. Applied consistently across markets, that is what cross-border compliance now requires, because the obligations themselves already operate on those terms.
‍

Regulatory Compliance Automation in Practice

Regulatory compliance automation is often reduced to faster screening, when the harder problem sits in everything that happens after an alert is raised. A single sanctions update, rule change or unusual payment has to move through assessment, review, decision and filing, and each handover is where manual operations lose time.

Automating that sequence gives the compliance team a defined path from detection to evidence:

• Detection: Transaction monitoring software applies configurable rules and behavioural analysis to flag activity that does not match the customer's profile, so suspicious patterns surface as they occur rather than during a later sample check.
• Prioritisation: Alerts are ranked and routed by risk, with escalation controls sending higher-risk matters to senior reviewers instead of leaving them in a shared queue.
• Investigation: Some cases need a closer look, and enhanced due diligence software gives analysts the wider screening, ownership detail and document trail to complete it without leaving the platform.
• Maintenance: Risk classification decides how often a customer comes back around for review, and periodic customer reviews keep those cycles running so records stay current between onboarding and the next regulatory question.
• Reporting: Regulatory reporting automation produces suspicious transaction reports and other filings in the formats local and global regulators require.

The value of AML compliance automation shows most clearly when obligations change. Rules, thresholds, escalation routes and review cycles can be reconfigured as new requirements take effect, without rebuilding the process or asking analysts to remember which customers are affected by which update.
‍

Building Real-Time Compliance at Scale

Regulatory change is no longer an event a compliance team responds to a few times a year. Sanctions lists are updated, supervisory expectations are raised and technology standards are set across several markets at once, and the fintechs that hold their licences and their banking relationships will be those whose controls move at the same speed.

That capability is built, not bought at the last minute. It rests on screening that runs continuously instead of on a calendar, workflows that can be reconfigured as obligations change, and records that stand up when a regulator or partner bank asks how a decision was reached. Global compliance for fintechs comes down to those three things working together across every market the business touches.

FlexM is a leading global fintech conglomerate, and it built FlexComply for exactly this environment. The platform brings onboarding, screening, monitoring, case management and reporting together, and it is maintained as requirements evolve across markets, so a compliance team can absorb a shift in sanctions, supervisory expectations or AI governance by adjusting its configuration instead of rebuilding its controls.

For banks, fintechs and money services businesses, regulatory compliance automation of that kind strengthens the compliance function itself. Analysts spend their time on judgement rather than collation, decisions carry their own evidence, and AML compliance automation handles the volume that would otherwise dictate how many people the team needs to hire.

Compliance capability decides how confidently a fintech can enter its next market. Building it before the next rule changes is what separates the firms that expand from the firms that spend the year catching up.

                                                                                                                                                       [Automate Your Compliance] 
                                                                                                     Focused 1:1 to map your global regulatory exposure

‍

What happens to your AML obligations now that DCR 2026 has closed?

Bank Negara Malaysia required reporting institutions including DNFBPs to file the Data and Compliance Report by 30 September 2026. The submission window is now closed, no extension was granted, and DCR 2026 is final for every firm that filed.

What follows differs by firm. Those that submitted are waiting on a report card from BNM that will set out the specific compliance gaps found in their answers. Those that did not are exposed to enforcement under the AMLA, the FSA and the IFSA.

The obligations themselves run year-round, independent of any reporting window. BNM DCR 2026 assessed how a firm operates day to day, not what its policies state on paper.

Which is why AML compliance Malaysia is judged across the whole business cycle rather than at the point of filing.
‍

What Changed in DCR 2026 Malaysia This Cycle?

BNM widened the reporting population for this cycle. Licensed gaming outlets, moneylenders, pawnbrokers, trust companies, factoring companies and leasing companies now submit alongside the lawyers, accountants, company secretaries, registered estate agents and DPMS firms that reported in 2024.

The submission also moved to the Dynamic Submissions Portal, a system-based platform with input validation, draft saving and a discussion function that routes questions on the form directly to BNM and the statutory regulatory bodies.

DCR 2026 Malaysia now reaches a much larger share of the businesses that handle client money and set up corporate structures in Malaysia.

Whatever a reporting institution submitted stays confidential. BNM uses it for supervisory purposes and risk assessments.
‍

What Happens After DCR Submission: The BNM Report Card?

BNM reviews every completed submission and issues a DCR report card setting out the gaps found in a firm's answers.

It goes to the email address the firm entered at question A4 of the DCR form, and BNM notes it may land in spam or junk rather than the inbox.

The report card is not an enforcement notice. BNM positions it as a self-assessment tool, meant to show a firm where its AML/CFT/CPF processes need strengthening.

Its value lies in what it is. A regulator's reading of a firm's controls, naming specific weaknesses, drawn from the firm's own account of its practice under DCR 2026.
‍

Reading Your DCR Compliance Gaps

Reading and interpreting your Data and Compliance Report gaps is a critical exercise, because each finding marks a point where a firm's defence against money laundering, terrorism financing and proliferation financing risk is thinner than the obligation requires. DCR compliance gaps are not regulatory checkboxes. They are indicators of structural vulnerability, and for DNFBPs, converting those indicators into a remediation plan is the step that matters.

Where the gaps most commonly sit:

• Beneficial ownership verification - Ownership traced only to the registered holder rather than through every layer of corporate shareholding to the individual who ultimately owns or controls the client.
• Customer due diligence - Identification collected without independent verification, or verification completed after the relationship has already begun.
• Targeted financial sanctions screening - Screening run once at onboarding rather than continuously, or no defined procedure for handling a confirmed match.
• Customer risk profiling - Risk assigned through a partner's judgement on individual files instead of a standardised process applied to every client.
• Enhanced due diligence - Source of funds, source of wealth and senior approval obtained after a higher-risk client has been taken on, rather than before.
• Ongoing due diligence - Client information left unchanged after onboarding, with no review of whether transactions still match the client's profile.
• Record keeping - Identification documents or transaction records held incompletely, or retained for less than the required period.
• Client information systems - No means of aggregating one client's transactions across multiple accounts, files and branches, whether the system is electronic or manual.
• Suspicious transaction reporting - Red flags that never reached employees, no internal escalation route, or no named decision-maker.
• Compliance programme - Written policies never approved, never updated against current requirements, or never distributed to staff.

Each of these sits in the Policy Document as a standing requirement. A finding in the DCR report card identifies where a firm is falling short of AML/CFT/CPF Malaysia obligations that applied before the submission and continue to apply after it.
‍

Where a Missed DCR 2026 Submission Leaves Your Firm?

Missing the 30 September deadline places a firm in breach of a mandatory and enforceable requirement. BNM set out what that breach carries in its DCR 2026 information kit, and for some sectors the consequences extend beyond the regulator.

What a missed DCR 2026 submission exposes a firm to:

• Statutory non-compliance- Failure to submit constitutes non-compliance with the AMLA, the FSA and the IFSA, as the case may be.
• Enforcement action - BNM may pursue enforcement under the applicable laws, including the imposition of monetary penalty. The Malaysian Bar relayed the same warning to its members in Circular 205/2026.
• Professional body consequences - For accountants, non-submission is also a breach of the MIA By-Laws on professional ethics, confirmed in the joint circular issued by BNM and MIA.
• No report card- BNM issues report cards only for completed submissions, which leaves a non-filing firm without the regulator's assessment of its own gaps.

Before anything else, a firm should establish whether the obligation applied to it at all. BNM DCR 2026 exempted firms with no legal existence, in-house company secretaries, lawyers and accountants, and firms notified of a BNM on-site or off-premise examination in 2025 or 2026. Firms that were dormant, had no clients across 2024 and 2025, or provided no gazetted activities were required to file only a Declaration Form.

Where the requirement did apply, BNM handles DCR enquiries at dcr@bnm.gov.my. The underlying obligations remain in force for every reporting institution Malaysia covers, whether or not a submission was made.
‍

The Ongoing AML Obligations That Run Regardless of the DCR

Ongoing AML obligations are the duties that sit inside a firm's day-to-day operations rather than on a compliance calendar. Under AML/CFT/CPF Malaysia requirements, they apply every time the business takes on a client, handles a transaction or receives new information, which means their timing is set by the firm's own activity, not by BNM's reporting cycle.

A DCR asks firms to describe these obligations after the fact. Meeting them as they arise is what gives that description substance, and it is the foundation of AML compliance in Malaysia between one cycle and the next.
‍

Preparing for the Next DCR Cycle

BNM has run the DCR in 2020, 2021, 2022, 2024 and 2026, and while the timing of the next DCR cycle has not been announced, the pattern makes it one to plan for. Readiness comes down to whether a firm's records, decisions and business data are already held in a form that can answer BNM's questions when they arrive, rather than being rebuilt under a deadline.

What that looks like in practice:

• Business data captured by calendar year - DCR 2026 Malaysia asked for revenue or transaction value, transaction numbers, inward and outward cash values, payment methods, and client numbers by type and nationality, each broken down by year. Holding those figures in that shape as the year runs removes the heaviest lift from any future submission.
• Decisions recorded when they are made - Client risk ratings, enhanced due diligence approvals and decisions on whether to file a suspicious transaction report should carry a date and a named decision-maker at the time, not added later.
• Report card findings kept as a working log - Each gap assigned to an owner, with the action taken and the date it closed, so the firm can show progress rather than describe it.
• Compliance Officer details kept current - The CO number issued by BNM remains valid across cycles, and the report card goes to the firm's registered email, so both need to reflect who actually holds the role.
• Changes in scope tracked - New gazetted activities, additional branches or a change in group structure can alter which form a firm files and how many submissions it makes.

A firm that meets its ongoing AML obligations this way already holds most of what the next submission will ask for.
‍

Making AML Compliance Malaysia a Year-Round Standard

AML regulation in Malaysia keeps changing. In 2026 alone, the AMLA (Amendment) Act 2025 came into force on 1 March, and DCR 2026 brought six new sectors into BNM's reporting scope.

Every change of this kind extends what a reporting institution must verify, document and report. Where those processes are manual, each amendment means redesigning them. Where they run on an integrated, automated system, new requirements can be absorbed into existing workflows, and AML compliance Malaysia stays aligned with the regulation as it evolves.

FlexComply, from leading global fintech conglomerate FlexM, is built for exactly that. It provides end-to-end AML coverage through connected modules with audit-ready records, designed to adapt as regulatory obligations shift and to scale with a firm's growing exposure.

‍

                                                                                                                                                                       [Automate Your Ongoing AML Obligations] 
                                                                                                                              A 30-minute session mapped to your report card findings

‍

Ugandan banks and RFSPs are holding SACCO relationships without a settled rule for how to treat them after 30 September 2026. The Bank of Uganda SACCO licensing deadline was set in a February 2026 notice, directing regulated financial service providers to update their Know Your Customer practices and restrict transactions to licensed SACCOs from that date, which was carried forward once from 31 March.

Licensing progress across the sector shows how much is riding on that instruction. Seven of roughly ninety qualifying large SACCOs held a licence in early September 2026, with fifteen further applications in process, so most large SACCO relationships will remain outside the licensed category when the SACCO deadline takes effect. Closing those accounts in advance carries its own difficulty, as the notice records that Bank of Uganda does not expect providers to withdraw financial services from eligible societies before the extension period ends.

Meeting the BoU SACCO licensing deadline comes down to what an institution can show about each SACCO on its books, which starts with what the notice actually asks for.
‍

What The BoU SACCO Licensing Deadline Requires?

The BoU SACCO licensing deadline was issued on 23 February 2026, directing regulated financial service providers to update their Know Your Customer practices and transact only with licensed Registered Societies or SACCOs by 30 September 2026, replacing an earlier date of 31 March.

What BoU expects before the deadline

Bank of Uganda asks providers to keep supporting societies that are still working through licensing, and states that it does not expect any provider to deny financial services to eligible SACCOs while the extension runs. An institution that closes SACCO accounts early to reduce exposure would be acting against both.

Why the deadline moved

The six extra months serve the licensing process rather than the institutions banking these societies. Bank of Uganda set the extension to create room for stakeholder engagement and public awareness on its licensing role, and to give eligible societies longer to prepare their documentation. What comes out of those consultations could reshape the licensing regime, which Bank of Uganda has left open.

Where the licensing authority sits

Small SACCOs are supervised by the Uganda Microfinance Regulatory Authority. Once a society crosses the thresholds set in the MDI Act Cap 58 and its 2023 Registered Societies Regulations, it needs a licence from the Bank of Uganda instead.
‍

Who The SACCO Deadline Applies To?

The licensing deadline applies to SACCOs required to obtain a Bank of Uganda licence. It also has a direct compliance impact on regulated financial service providers, because the February 2026 BoU notice sets out how they are expected to handle SACCO relationships as the deadline takes effect.

Which SACCOs require a licence

Large SACCOs require a Bank of Uganda licence to continue taking deposits. Every other SACCO stays under the Uganda Microfinance Regulatory Authority, which also supervises Tier 4 microfinance institutions and money lenders, and is not eligible for a Bank of Uganda licence.
‍

What Counts As A Large SACCO Under Uganda's SACCO Regulation?

Bank of Uganda applies financial thresholds to determine which societies need a licence. A society qualifies as a large sacco uganda institution once its voluntary savings exceed UGX 1.5 billion and its institutional capital exceeds UGX 500 million, as specified by Bank of Uganda.

Voluntary savings are the deposits members place with a society for safekeeping and future use.

The statutory basis

The legal framework for SACCO regulation in Uganda in 2026 is set out in the MDI Act Cap 58, together with the Microfinance Deposit-Taking Institutions (Registered Societies) Regulations, 2023. A society that meets the prescribed thresholds falls under this framework and comes within Bank of Uganda supervision. In August 2026, the Bank of Uganda and the Ministry of Finance estimated that around 90 societies met the criteria.
‍

SACCO KYC Requirements Uganda: What RFSPs Need On File

RFSPs should have enough KYC information on file to identify each SACCO customer, verify that information against reliable and independent sources, and understand the customer’s risk. The exact checks depend on the risk involved, but the underlying requirement comes from Uganda's Anti-Money Laundering Act: customer identity must be established and verified, with appropriate records kept to support the relationship and any transactions. For SACCOs operating after the deadline, RFSPs should also verify and retain evidence of the society’s Bank of Uganda licence status.
‍

Existing due diligence obligations

A SACCO is a corporate customer, and Customer Due Diligence on a corporate customer under Ugandan law covers:

• Identification of the society itself
• Identification of the beneficial owners, with reasonable measures taken to verify them
• Understanding the purpose and intended nature of the business relationship
• Ongoing monitoring of the relationship and the transactions running through it
• Retention of the resulting records for ten years, per ESAAMLG's account of section 7(3)
  ‍

Handling unlicensed societies after the deadline

Bank of Uganda has warned that SACCOs failing to license risk penalties. It has said nothing about what happens to the institutions banking them.

Providers were asked to support societies through the licensing process, and Bank of Uganda stated that it does not expect financial services to be withdrawn from eligible SACCOs. Until that changes, closing an account over a pending licence runs ahead of the supervisor.
‍

BoU SACCO Licence Application: What RFSPs Should Understand About the Pipeline

The licensing pipeline leaves RFSPs with a moving target. A SACCO can be preparing its application, have submitted it, or be further along in the Bank of Uganda review process, while still not appearing as a licensed society. Those stages matter because the September deadline turns on the licence itself, not simply on whether an application has been lodged.

For an RFSP, this makes the licensing record more useful than a one-time KYC check. The SACCO’s status may need to be checked again as the deadline approaches, particularly where an existing relationship depends on the society completing the process.

Public information from the Bank of Uganda can establish the licensed population and provide updates on overall licensing progress. It does not, however, provide RFSPs with a public live tracker for every application. Where the position of a particular SACCO is unclear, the evidence available from the society or confirmation from BoU becomes important.

The practical issue is therefore not whether a SACCO says it has applied. It is whether the RFSP can establish its current licensing position and keep that evidence with the relationship record.
‍

Preparing for the SACCO Deadline: An RFSP Checklist

1. Map SACCO relationships against the Bank of Uganda thresholds for large societies
2. Record each society's current licensing position and request supporting confirmation where it is unclear
3. Set a review date for relationships where licensing or regulatory status is still changing.
4. Escalate unresolved cases through compliance or risk rather than leaving them with the relationship manager
5. Keep the evidence together: KYC records, licensing information, correspondence and the decision taken on the relationship.
6. Check for further Bank of Uganda guidance before the deadline, since BoU large SACCO compliance rules may be revised following the supervisor's consultations
7. Contact the Director, Non-Bank Financial Institutions Department on +256 414 234652 where direct clarification on licensing or regulation is required.
   ‍

What The Bank Of Uganda SACCO Licensing Deadline Leaves Open?

The February 2026 notice settles the extension period, but it does not answer every question that may arise when that period ends. In particular, it does not set out a separate procedure for relationships affected by a SACCO's licensing status, or explain how RFSPs should handle cases that remain unresolved at the end of the period.

That leaves the next formal communication from Bank of Uganda important for compliance teams. Any change to the BoU SACCO licensing deadline, the licensing framework or the treatment of affected relationships would need to come through the regulator rather than being inferred from an application, a pending review or industry expectations.

There is also a live development to watch. UCSCU said in August 2026 that it had reached an understanding with BoU to have the September deadline lifted, with a memorandum of understanding expected to follow. Those statements came from the union rather than from Bank of Uganda, and no confirming BoU notice has been identified. RFSPs should therefore distinguish between reported developments and the regulator's published position when updating records against bank of uganda sacco licensing requirements.

‍

FlexM, a leading global fintech conglomerate, offers an end-to-end AML compliance solution in FlexComply, built to help RFSPs meet customer due diligence, beneficial ownership, ongoing monitoring and record retention requirements across counterparties entering formal supervision for the first time.

Institutions that put that discipline in place now will be ready for whatever Bank of Uganda communicates next, rather than rebuilding their approach around each new date.

                                                                                                                                  [Explore FlexComply for SACCO compliance]

                                                                                                                          A 1:1 working session on your counterparty compliance.

‍

‍
‍

If the SASRA licence renewal feels more demanding in 2026 than it did a few years ago, there is a straightforward reason for it. 

The compliance standard that SASRA Kenya is applying to every deposit-taking SACCO in Kenya has genuinely shifted and institutions whose AML programmes were built for an earlier regulatory environment are feeling that most acutely right now.

The AML Amendment Act 2025 expanded SASRA's supervisory authority directly and the enforcement that followed made clear that this was not a legislative formality. The compliance gaps catching institutions out are not extraordinary failures either. They are the kind that accumulate quietly inside SACCOs in Kenya managing AML obligations manually, without the infrastructure to sustain them continuously across a full calendar year.

What follows is a clear breakdown of what SASRA and the FRC now expect from your AML programme, where most Kenyan SACCOs are currently falling short and what being genuinely examination-ready before September 30 actually requires.
‍

Why 2026 SACCO Compliance in Kenya Looks Different?

The AML Amendment Act 2025 amended the Sacco Societies Act directly, giving SASRA Kenya an explicit legislative mandate over AML supervision that is meaningfully stronger than what existed before it. The September 30, 2025 renewal was the first time Kenyan SACCOs encountered that mandate in its full form and the results were immediate.

Five deposit-taking SACCOs were issued conditionally restricted licences following governance and compliance failures and have spent all of 2026 barred from taking new member deposits. 

With September 30, 2026 approaching, 2026 SACCO compliance in Kenya is being shaped by what that enforcement cycle revealed about the gap between what SASRA Kenya now expects and what most institutions currently have in place.
‍

The SASRA Licence Renewal Kenya Deadline: What September 30 Actually Means

Kenya's deposit-taking SACCOs operate on a licence that expires every December 31. 

Section 25 of the Sacco Societies Act requires renewal applications to reach SASRA 90 days before that expiry, which is what makes September 30 the date every regulated SACCO in Kenya works backwards from.

Getting that submission right means satisfying SASRA's renewal checklist across governance, capital and compliance:

• Fit-and-proper declarations for all board members and senior management
• Proof of minimum core capital of KSh 10 million
• Proof of FRC registration for AML compliance

That last requirement is what makes the SASRA September 30 deadline a compliance conversation and not just an administrative one. Proof of FRC registration tells SASRA your institution has been operating as a reporting institution under POCAMLA with active, ongoing obligations. 

In 2026, the SASRA licence renewal examination goes beyond confirming that registration exists to understanding whether the compliance programme behind it has actually been running and the SASRA renewal requirements are being assessed with that distinction clearly in mind.
‍

SASRA Kenya and the FRC: Understanding the Compliance Relationship

SASRA and the FRC play distinct but interconnected roles in Kenya's AML supervisory framework.

Under Kenya's sector-based supervisory model, SASRA is the designated AML supervisory body for all regulated SACCOs. 

The FRC, operating as Kenya's Financial Intelligence Unit, is where suspicious transaction reports are filed and where AML reporting quality is assessed. 

Registration on the FRC's goAML portal is mandatory for every deposit-taking SACCO under Section 47A(1) of POCAMLA and it is treated as a baseline compliance requirement at renewal, not an administrative formality.

What this means in practice is that AML compliance for SACCOs in Kenya is not a single-regulator obligation. SASRA and the FRC both have oversight over your institution's AML programme and your FRC registration is the thread that connects both relationships at renewal. An institution that treats its FRC obligations as separate from its SASRA standing is managing two compliance relationships as though they are one, and September 30 is typically where that assumption gets tested.

‍

SACCO Regulations Kenya: What POCAMLA Requires From Every DT-SACCO

Every deposit-taking SACCO in Kenya carries a set of active, ongoing AML obligations under POCAMLA that extend well beyond FRC registration and run continuously throughout the year, not just at renewal.

Appointment of a Money Laundering Reporting Officer

Every SACCO must appoint an MLRO at management level. The FRC is explicit that this role cannot be held by the CEO or the Internal Auditor and any change in MLRO must be notified to the FRC within 14 days of the appointment.

Suspicious Transaction Reporting

Under POCAMLA, suspicious transactions must be reported to the FRC within two days of suspicion arising. The AML Amendment Act 2025 made delayed STR filing explicitly non-compliant, not a timing issue. For institutions running manual monitoring processes, consistently meeting that window across a full membership base is where the operational gap tends to show.

Cash Transaction Reporting

Cash transactions at or above USD 15,000 must be filed with the FRC at the end of the week in which they occurred, or immediately where circumstances demand earlier reporting.

Customer Due Diligence and KYC

Static onboarding records do not satisfy POCAMLA compliance Kenya 2026. Risk profiles must be continuously updated as member behaviour changes and KYC records must reflect the current status of your membership, not the status at sign-up.

Beneficial Ownership

Self-declaration of ownership structure is not enough for corporate and Chama members alike. Under Kenya's 2020 Beneficial Ownership Regulations you must independently identify any natural person who owns 10% or more ownership or exercises significant control and document and maintain this as part of your SACCO AML programme Kenya.

Record Retention for Seven Years

KYC files and transaction logs must be kept for at least seven years and be searchable on demand. Records that exist but are not readily producible carry the same risk of noncompliance as records that do not exist.
‍

The SASRA September 30 AML Checklist for Kenyan SACCOs

Across Kenya's regulated cooperative sector, the same compliance gaps tend to surface at renewal year after year. Not because institutions are unaware of their obligations but because maintaining them continuously, across a full membership base, is harder than most compliance calendars are built to accommodate.

The institutions that clear September 30 without complications are not doing more compliance work in August. They are the ones that resolved this gap before the deadline made it urgent.

‍

What Happens When SASRA Licensed SACCOs Fall Short?

For SASRA licensed SACCOs that arrive at renewal without meeting the due regulatory requirements, the consequences are well documented from the 2026 licensing cycle and they are not administrative inconveniences.

Conditionally Restricted Licence 

The institution can be limited to credit-only operations and strictly prohibited from taking new or further member deposits for the entire licensing year. Existing member balances and loans remain intact but no new deposits can be accepted from members or the public.

Enhanced Regulatory Conditions 

SASRA can impose additional compliance requirements on top of existing obligations, placing the institution under closer supervisory scrutiny going into the following year's renewal cycle.

Full Licence Revocation 

Where an institution fails to apply for renewal or cannot meet its obligations, its authorisation is automatically revoked and it is prohibited from conducting any regulated SACCO business with immediate effect.

Public Gazette Notice 

SASRA publishes the full list of restricted and revoked institutions in the Kenya Gazette, making the outcome visible to members, employers and the broader market. For a sector built on member trust, that visibility carries consequences well beyond the regulatory cycle in which it occurs.
‍

From Deadline Compliance to Year-Round Readiness

Kenya's SACCO sector is at an inflection point and the institutions that will navigate it most successfully are the ones that have stopped treating AML compliance as a deadline-driven exercise and started treating it as year-round infrastructure. SASRA Kenya's enforcement posture in 2026 has made the cost of the alternative very clear.

2026 SACCO compliance in Kenya demands a programme that runs continuously, documents everything and holds up under examination, not one that gets assembled in August and presented in September. The obligations under POCAMLA, the FRC's reporting requirements and SASRA's supervisory expectations are not seasonal. They compound over time and the gap between meeting them and appearing to meet them is exactly what renewal examinations are designed to surface.

FlexComply, the award-winning end-to-end AML compliance solution from FlexM, a leading global fintech conglomerate, gives deposit-taking SACCOs in Kenya the compliance infrastructure to close that gap permanently. From FRC goAML compliance and automated STR filing to continuous member risk profiling and a full immutable audit trail, FlexComply keeps your AML programme examination-ready all year round so September 30 is a date you meet, not one you dread.

Get started with FlexComply today!

‍

If your team still treats enhanced due diligence Malaysia 2026 as a quarterly checkbox exercise, you are not simply behind the curve, you are standing precisely where Bank Negara Malaysia's next enforcement action is destined to land.

In January 2026, BNM shifted the compliance landscape for every reporting institution in the country by penalising firms not for systemic negligence, but for isolated oversights. A single customer without adequate EDD (Enhanced Due Diligence). A one-off suspicious transaction report filed a few days late. One nominee account that slipped through without proper scrutiny. These are not penalties against reckless firms. These are penalties against firms that thought they were doing everything right. By targeting these precise, singular gaps, BNM has established a zero-tolerance precedent that renders the traditional playbook of periodic reviews and static name-screening obsolete overnight.

The message could not be louder: firms still operating on manual cycles and quarterly review windows are no longer compliant, they are merely lucky. And in this new era of precision enforcement, luck is not a regulatory strategy.

‍

From Policy to Penalty: How BNM Changed the Game in 2026

‍

For years, the BNM AML/CFT Policy Document was something compliance teams referenced during audits and training sessions but rarely felt the weight of it in daily operations. The 2024 revised policy introduced stricter language around customer due diligence and STR timelines, but many firms treated it as an update to read and revisit later.

2026 has made that approach impossible.

In January alone, BNM moved from guidance to direct enforcement:

• Boardroom Corporate Services was compounded RM46,000 for failing to conduct EDD on one high-risk customer and two customers receiving nominee services
• SME Bank faced a RM460,000 Administrative Monetary Penalty for delays in submitting Suspicious Transaction Reports
• Ilham Secretarial Services was fined RM8,625 for a single failure to report irregular transactions

Combined penalties exceeded RM500,000 in just one month.

What makes this moment different is not the size of the fines. It is the type of firms being targeted and the nature of the failures being penalised. BNM is no longer reserving enforcement for large financial institutions with repeated, documented breakdowns. Every Reporting Institution, regardless of size or sector, is now held to the same standard of continuous regulatory compliance.

‍

The 2026 "Gatekeeper" Warning: In January 2026, BNM issued over RM500,000 in combined penalties against non-bank reporting institutions. The common thread was a failure to perform Enhanced Due Diligence on high-risk profiles and delays in STR submissions. For Malaysia's 20,000+ reporting institutions, including DNFBPs & NBFIs, manual, periodic checks are no longer enough to satisfy BNM's 2026 digital-first mandate.

                                                                                          Discover exactly how automation replaces your manual EDD process

What Does the 2026 Regulatory Compliance Landscape Actually Look Like?

Understanding why BNM has tightened its enforcement posture requires looking at the bigger picture. Malaysia's financial crime environment has deteriorated rapidly, and the regulatory infrastructure is evolving to match.

E-financial fraud cases in Malaysia saw a 185% increase in a single year while the losses from these incidents reached RM458 million. These are not projections or global benchmarks. These are Malaysian numbers, from Malaysian institutions, reported by Malaysia's own National Cyber Security Agency.

Three major regulatory shifts define the 2026 landscape:

• Basel III Malaysia implementation 2026 is now actively shaping how reporting institutions calculate and report operational risk. Compliance is no longer siloed within AML teams; it intersects with capital adequacy, liquidity management, and enterprise-wide risk governance
• Operational Risk Reporting (ORR) BNM 2026 has introduced a new submission framework requiring system-level data feeds, not manually compiled spreadsheets. For many DNFBPs (Designated Non-Financial Businesses and Professions) and smaller NBFIs (Non-Bank Financial Institutions), this alone represents a fundamental infrastructure upgrade
• The Data and Compliance Report (DCR) 2026 remains BNM's primary supervisory tool, but the bar for acceptable submissions has risen sharply. BNM is now cross-referencing DCR data against enforcement findings, meaning inconsistencies between what you report and what BNM observes during inspections will trigger deeper scrutiny and potentially penalties under Section 92 of AMLA

The picture is clear: BNM is building a compliance ecosystem that runs on real-time data, digital infrastructure, and continuous monitoring. Firms still operating on periodic cycles are not just at risk of falling behind, they are at risk of falling foul of a system designed to catch exactly that kind of gap.

‍

What Has Actually Changed in EDD Processes This Year?

The BNM EDD requirements for DNFBPs and reporting institutions across the board have shifted significantly in 2026. These are not incremental updates to existing expectations. They are specific operational changes that affect every reporting institution, whether a bank, MSB, fintech, insurance firm, or professional services provider.
‍

Mandatory Source of Wealth Verification for Foreign PEPs

Reporting institutions must now verify both Source of Funds and Source of Wealth for any customer identified as a foreign Politically Exposed Person (PEP). This is not a recommendation. It is a mandatory requirement. The distinction matters because many firms have historically verified where the money for a specific transaction came from without investigating how the customer accumulated their overall wealth. In 2026, doing one without the other is a gap that BNM has explicitly stated it will penalise.
‍

Beneficial Ownership Reporting Malaysia: The "Look Through" Principle

BNM now expects reporting institutions to go beyond the first layer of corporate structure and identify the natural persons who ultimately own or control a customer entity. For firms dealing with:

• Complex multi-layered corporate structures
• Nominee arrangements
• Trust-based ownership models

This requirement demands investigative depth that static document collection cannot provide. The Institutional Risk Assessment (IRA) BNM framework now factors beneficial ownership transparency directly into a firm's overall risk rating, meaning gaps in BO verification do not just expose you to penalties, they elevate your entire institutional risk profile.

Targeted Financial Sanctions (TFS) Malaysia Screening

Screening obligations have tightened considerably. BNM now requires:

• Real-time screening against domestic lists maintained by the Ministry of Home Affairs
• Screening against international lists including UNSCR sanctions
• Continuous, event-triggered screening that captures changes in designations as they happen, not weeks or months after the fact

The expectation is no longer that firms screen customers at onboarding and periodically thereafter. It is ongoing, automated, and immediate.

Ongoing KYC Verification and Monitoring

The traditional approach to anti-money laundering Malaysia 2026 updates relied on officers manually reviewing transactions against static red flag lists. That model simply cannot handle the volume and speed of today's transaction flows.

BNM now expects automated systems that perform ongoing due diligence, learn customer behaviour and flag genuine anomalies, freeing compliance officers to focus on real risks rather than drowning in false positives.

• KYC verification must be refreshed at frequencies determined by the customer's risk profile
• High-risk customers require substantially more frequent reviews
• Transaction monitoring must be continuous and behavioural, flagging deviations from a customer's established patterns rather than just transactions crossing a static threshold

The shift from rule-based to behaviour-based monitoring is one of the most significant operational changes facing compliance teams this year.
‍

Technology Is No Longer Optional for EDD Compliance

BNM's 2026 framework is built on the assumption that firms will use technology to meet these obligations. Manual processes simply cannot keep pace with what is now required.

MyDigital ID: The Infrastructure Shift Nobody Can Ignore

2026 is the year MyDigital ID moves from pilot to implementation across Malaysia's financial sector:

• 18 banks completed Phase 2 sandbox testing for e-verification
• 15 banks and fintechs, including Maybank, CIMB, Public Bank, and RHB, signed integration agreements
• E-verification now links directly to the National Registration Department database as a single source of truth

For EDD, this means KYC (Know Your Customer) checks and identity verification are shifting to real-time, government-database-linked authentication. MyDigital ID verifies identities against the National Registration Department database, providing a single source of truth for customer identity.
‍

Your 2026 Enhanced Due Diligence Compliance Checklist

1. Update your Institutional Risk Assessment to reflect 2026 regulatory changes, customer base, and geographic exposure
2. Implement real-time PEP checks and sanctions screening with event-triggered rescreening against domestic and international lists
3. Verify both Source of Wealth and Source of Funds for all foreign PEPs and high-risk customers
4. Apply the "Look Through" principle to identify ultimate beneficial owners behind layered structures and nominee arrangements
5. Deploy behavioural transaction monitoring that flags pattern deviations, not just threshold breaches
6. Automate STR workflows to eliminate the filing delays BNM penalised in January 2026
7. Prepare for MyDigital ID integration in your onboarding and verification workflows
8. Cross-verify your DCR 2026 submission against internal records before filing
   ‍

Preparing for What Comes Next

BNM's 2026 enforcement actions are the starting point, not the finish line. Malaysia is preparing for its next Financial Action Task Force (FATF) mutual evaluation, and the country's performance will directly shape regulatory expectations for years ahead.

For reporting institutions looking to bridge the gap between where their compliance operations stand today and where BNM expects them to be, FlexM, the leading global fintech conglomerate, offers FlexComply, a 360-degree compliance platform built for exactly this regulatory environment. With automated KYC verification, real-time PEP checks, and enhanced due diligence capabilities aligned to BNM's 2026 framework, FlexComply enables firms to move from reactive compliance to continuous, confident oversight.

                                                                                       Most firms fail 3 of these 8 checks. Find out which ones

‍