Name
Global FinTech Guide
Country _ Name
Kenya
SectionTitle
KYC requirements
Body
The know your customer or know your client (KYC) guidelines and regulations for financial services require that professionals try to verify the identity, suitability, and risks involved with maintaining a business relationship.

Legal affairs

National regulatory framework regarding AML and effective date of the regulations

Kenya’s national regulatory framework for Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements is governed by the Anti-Money Laundering and Combating of Terrorism Financing Laws (Amendment) Act, 2023, which was assented to on September 1, 2023, and came into effect on September 15, 2023. This Act introduced significant enhancements, including expanded beneficial ownership disclosure requirements for all companies and limited liability partnerships, with compliance deadlines set for November 15, 2023. It also strengthened customer due diligence obligations, mandating thorough verification of client identities and business relationships. Additionally, entities must maintain financial transaction records for at least ten years. The law imposes stricter penalties for non-compliance, aligning Kenya’s AML and KYC standards with international best practices to improve transparency and combat illicit financial activities.



National regulator or relevant authority for AML controls

Kenya's national regulatory framework for Anti-Money Laundering (AML) and Know Your Customer (KYC) compliance is primarily overseen by the Financial Reporting Centre (FRC), established under the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) of 2009. The FRC serves as the country's Financial Intelligence Unit, responsible for receiving, analyzing, and disseminating financial intelligence to combat money laundering and terrorist financing. Additionally, the Central Bank of Kenya (CBK) plays a crucial role in regulating and supervising financial institutions, ensuring they adhere to AML and KYC regulations. Other sector-specific regulators include the **Capital Markets Authority (CMA) for the securities market and the Insurance Regulatory Authority (IRA) for the insurance sector. These agencies collaborate to enforce compliance and maintain the integrity of Kenya's financial system.



Customer Due Diligence

Conduct of a typical KYC identification process

In Kenya, the typical Know Your Customer (KYC) identification process involves several key steps designed to verify the identity and assess the risk profile of clients. Initially, financial institutions or service providers collect basic personal information such as full name, date of birth, nationality, and physical address. This is followed by verification using valid government-issued identification documents like the national ID card, passport, or driving license. For individuals, biometric data such as fingerprints or facial recognition may also be captured, especially with advancements in digital onboarding.
Institutions then conduct risk assessments based on the client’s background, source of funds, and nature of the business relationship. Enhanced due diligence applies for high-risk customers, such as politically exposed persons (PEPs) or those from high-risk jurisdictions. The process includes ongoing monitoring of transactions to detect suspicious activities. Throughout, compliance with Kenya’s AML laws and the Data Protection Act ensures client data is securely handled and privacy is maintained.



Possibility to meet customer due diligence requirements by relying on third parties who are obliged by law themselves to comply with AML regulations

In Kenya, financial institutions and FinTechs can meet customer due diligence (CDD) requirements by relying on third parties, provided those third parties are legally obligated to comply with AML regulations themselves. This means that if a trusted intermediary—such as a regulated bank, insurance company, or licensed financial service provider—has already conducted proper KYC and AML checks, another institution may rely on their verification to satisfy its own CDD obligations. However, the relying institution remains ultimately responsible for ensuring the third party’s compliance and must conduct ongoing monitoring. This approach helps reduce duplication, improve efficiency, and align with international AML best practices.



Possibility to outsource customer due diligence by contract to other third parties who are not obliged by law to meet AML regulations and rely on these (e.g., WebID, IDnow, PostIdent)

Outsourcing customer due diligence (CDD) to third parties not legally obligated to comply with AML regulations, such as identity verification service providers like WebID, IDnow, or PostIdent, is a nuanced issue in Kenya. While these vendors offer advanced technological solutions for KYC processes, financial institutions remain fully responsible for regulatory compliance under Kenyan AML laws. Therefore, outsourcing is permitted only if the outsourcing institution performs thorough due diligence on the service provider, ensures contractual obligations for AML compliance, and maintains oversight of the process. Institutions must verify that these providers meet Kenya’s legal standards, implement robust data protection measures, and allow for audit and monitoring to mitigate compliance risks effectively. Ultimately, regulatory authorities expect the primary institution to retain full accountability regardless of outsourcing arrangements.



Presence of a license or registration requirement for the third party in case of outsourcing customer due diligence
In Kenya, when a financial institution (referred to as a "reporting institution") considers outsourcing customer due diligence (CDD) functions to third parties, the Proceeds of Crime and Anti-Money Laundering Regulations, 2023, stipulate specific conditions. These regulations permit such outsourcing only if the third party is regulated, supervised, or monitored by a competent authority and has established measures for compliance with CDD and record-keeping requirements in line with the Act and these Regulations. Therefore, while the third party does not necessarily need to be licensed in Kenya, they must be subject to equivalent regulatory oversight in their jurisdiction. The ultimate responsibility for ensuring compliance with CDD measures remains with the reporting institution, even when outsourcing these functions.



Further questions

Entities that could be relied on specifically by law as a third party to comply with AML regulations (regardless of outsourcing)


  credit institutions
  financial institutions
  auditors, external accountants, and tax advisors
  notaries and other independent legal professionals
  other trust or company service providers
  estate agents
  other persons trading high-value goods
  providers of gambling services


Authors

Close

Choose country