Building an AML Risk Assessment for a Kenyan Fintech or DCP: Where Do You Even Start?

Start with how your product is actually used, then map the legal duties onto it. A sound AML risk assessment for a Kenyan fintech or digital lender describes who your customers are and how they reach you, shows which controls answer each risk, and feeds the reporting duties under the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA). One correction first: the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 that many guides still cite have been repealed. Your AML risk assessment now sits under the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026.

Which rules now apply to a digital lender

Kenya Law records Legal Notice 46 of 2022, the Digital Credit Providers Regulations, as repealed on 29 September 2026 by the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026. The 2026 Regulations apply to non-deposit taking credit business not regulated under another written law (regulation 3). Their transitional provisions say that a provider licensed under the 2022 Regulations continues to carry on business and is deemed licensed under the 2026 Regulations. Anyone already conducting non-deposit taking credit business that is not regulated elsewhere was required to apply for a licence or registration within six months of publication of the Regulations, and may continue operating while the application is pending.

On anti-money laundering, regulation 64 is short and direct. A non-deposit taking credit provider shall comply with POCAMLA and the Prevention of Terrorism Act, and a provider that fails to do so is liable to assessment of penalties and other sanctions. In other words, the Regulations do not replace the statute; they make non-compliance a licensing and supervisory problem as well as a criminal one.

Build the AML risk assessment around your product

Regulation 23 requires a non-deposit taking credit provider to put in place a risk management framework consistent with its business model, so that all relevant risks are identified, assessed and mitigated. The list of risks the framework must cover includes money laundering and terrorism financing risk, alongside credit, operational, compliance, cybersecurity and data privacy risk. That wording is the best anchor for an AML risk assessment: it must reflect your business model, not a bank template.

The questions that matter for a digital lender differ from those for a branch-based lender:

• How much onboarding happens with no human ever seeing the customer?
• Do you lend through agents, or purely through an app?
• Are loans small and high-volume, which changes how suspicious patterns look, or larger and less frequent?
• Do you touch cross-border transfers or remittance corridors at all?
• How are repayments received, and can a third party repay on a borrower’s behalf?

Write the answers down, rate each risk, and tie every control you build to a rated risk. A control that answers no identified risk is cost without protection, and a risk with no control is a gap an inspector will find.

Identity checks where nobody meets the customer

Regulation 63 requires a provider to conduct customer due diligence and verify identities using independent source documents. For non-face-to-face transactions it must ensure the identity document is that of the person actually transacting, and it must guard against impersonation. POCAMLA section 45 separately obliges a reporting institution to identify and verify a person seeking a business relationship, by requiring an official record reasonably capable of establishing true identity. For a digital lender this means documenting how identity is verified, how mismatches are flagged, and what happens when verification fails instead of being waved through.

Higher-risk customers need more than the standard check. Decide in advance, in writing, which categories trigger enhanced due diligence automatically, so that the decision does not depend on a junior staff member’s judgement on the day. Our article on enhanced due diligence for politically exposed persons explains how that works in practice.

Monitoring, escalation and reporting

Section 44(1) of POCAMLA requires a reporting institution to monitor on an ongoing basis complex, unusual, suspicious or large transactions, and to pay attention to unusual patterns, including insignificant but periodic transactions with no apparent economic or lawful purpose. Where it suspects that a transaction or activity could constitute or be related to money laundering, terrorism financing, proliferation financing or the proceeds of crime, it must report to the Financial Reporting Centre in the specified manner within two days after the suspicion arose (section 44(2)). Section 44(3) extends the duty to attempted transactions.

Two supporting duties belong in your assessment. Section 47 requires internal controls and internal reporting procedures that identify the person to whom an employee reports suspicion, give that person access to relevant information, and require a direct report under section 44(2) when a sufficient basis exists. Section 47A requires reporting institutions to which the Act applies to register with the Centre, and to notify it of changes to registered particulars within ninety days. Records are governed by section 46. Whether your business is a reporting institution is determined by the Act’s own definitions, so confirm that point with advice before relying on it either way.

Putting it together for the Central Bank

When you apply for a licence under regulation 6, the application must be accompanied by, among other things, a copy of your AML and combating the financing of terrorism policies and procedures and a sworn declaration by the shareholders on the sources of funds and that the funds are not proceeds of crime. Regulation 62 separately requires evidence of the sources of funds invested. Once licensed, regulation 66 makes you subject to onsite and off-site inspection, audit and monitoring by the Central Bank.

A workable file therefore holds four things: a written description of how your product and customers create money laundering risk, the identity and due diligence controls mapped to that risk, clear rules for when a transaction is escalated, and the reporting steps that follow. Building it around your real product, and then following it, is what separates a document that survives inspection from one that sits in a folder.