FRC reporting Kenya requires regulated entities to file suspicious transaction reports and other disclosures with the Financial Reporting Centre under POCAMLA. The Financial Reporting Centre (FRC) is Kenya’s financial intelligence unit established under the Proceeds of Crime and Anti-Money Laundering Act 2009 (POCAMLA). The FRC receives, analyses, and disseminates financial intelligence to combat money laundering and terrorist financing in Kenya. A wide range of businesses and professions are required to register with the FRC as Reporting Institutions and to comply with extensive AML/CFT obligations including customer due diligence, transaction monitoring, and suspicious transaction reporting. Non-compliance with FRC reporting obligations exposes businesses to criminal penalties, reputational damage, and regulatory sanctions.

Who Must Register with the FRC in Kenya

The Second Schedule to POCAMLA lists the entities that are Reporting Institutions required to register with the FRC. These include: banks, microfinance institutions, and other financial institutions regulated by the CBK; insurance companies, brokers, and agents regulated by the IRA; CMA-licensed dealers, investment advisers, and fund managers; real estate agents and developers; lawyers and legal professionals handling client funds or property transactions; accountants and tax advisers; dealers in high-value goods including motor vehicles, precious metals, and gemstones; and trust and company service providers.

Core AML/CFT Obligations for Reporting Institutions

Customer Due Diligence (CDD)

Reporting Institutions must conduct Customer Due Diligence (CDD) on all customers and beneficial owners at the commencement of a business relationship and on an ongoing basis. Standard CDD requires: identifying the customer by name, address, nationality, and date of birth; verifying identity using official identification documents; identifying the beneficial owner where the customer is a legal entity; understanding the nature and purpose of the business relationship; and conducting enhanced due diligence (EDD) on higher-risk customers including Politically Exposed Persons (PEPs) and customers from high-risk jurisdictions.

Suspicious Transaction Reports (STRs)

Reporting Institutions are required to file Suspicious Transaction Reports (STRs) with the FRC where they know, suspect, or have reasonable grounds to suspect that a transaction or funds are connected to money laundering, terrorist financing, or proceeds of crime. POCAMLA does not set a fixed number of days for filing an STR; the obligation is to report as soon as practicable, without undue delay, once suspicion arises. The FRC’s own guidance treats a few business days as the practical benchmark, but this is a guidance expectation, not a fixed statutory deadline, so an institution should not treat a specific day count as a safe harbour. Tipping off the customer that an STR has been filed is a criminal offence under POCAMLA.

Cash Transaction Reports (CTRs)

Reporting Institutions that deal in cash must file Cash Transaction Reports (CTRs) with the FRC for all cash transactions equivalent to or exceeding US$15,000 in any currency, whether or not the transaction appears suspicious, or for multiple transactions that appear to be structured to avoid this threshold. Per the FRC’s own published guidance, a CTR is due at the end of the week in which the transaction occurred, unless the circumstances demand it be reported without delay, in which case it must be filed immediately.

Record Keeping Requirements

Reporting Institutions must maintain records of all customer due diligence documentation and transaction records for a minimum of seven years after the conclusion of the business relationship or the completion of the transaction. Records must be maintained in a form that enables the FRC to reconstruct the transaction history and the identity of the parties involved.

The Money Laundering Reporting Officer (MLRO)

Every Reporting Institution must appoint a Money Laundering Reporting Officer (MLRO) who is responsible for receiving internal reports of suspicious activity from staff, reviewing those reports, and determining whether an STR should be filed with the FRC. The MLRO must be a senior officer with appropriate authority and must receive regular AML/CFT training. In small entities such as law firms and sole practitioner accountants, the principal or managing partner typically serves as the MLRO.

FRC Inspections and Enforcement

The FRC conducts inspections of Reporting Institutions to assess AML/CFT compliance. Inspections may be routine (scheduled) or triggered by specific intelligence. A finding of non-compliance at an FRC inspection can result in: written directions requiring remedial action; imposition of administrative penalties; referral to the relevant sectoral regulator for licensing action; and in serious cases, criminal prosecution of the institution and its responsible officers. Penalties under POCAMLA include fines of up to KES 5 million per breach and imprisonment of up to five years for responsible persons.

As a Reporting Institution itself, Clay & Associates Advocates has direct experience operating under FRC compliance requirements. Our regulatory compliance practice provides AML programme design and implementation advisory services to businesses across all DNFBP categories. For financial services clients with the most intensive AML obligations, our team delivers comprehensive compliance frameworks. More information is available at the Financial Reporting Centre website.

Politically Exposed Persons and Enhanced Due Diligence

Politically Exposed Persons (PEPs) are individuals who hold or have held prominent public functions including senior government officials, politicians, judicial officers, military commanders, and executives of state-owned enterprises. PEPs present a higher risk of corruption and money laundering because of their access to public funds and decision-making power. Reporting Institutions are required by the FRC to apply Enhanced Due Diligence (EDD) to all PEP customers and to their close associates and family members. EDD for PEPs includes establishing the source of wealth (not just source of funds), obtaining senior management approval before establishing the business relationship, and conducting more frequent ongoing monitoring of PEP transactions.

Kenya and the FATF Mutual Evaluation

The Financial Action Task Force (FATF) conducted a Mutual Evaluation of Kenya’s AML/CFT framework in 2021, assessing Kenya’s compliance with the 40 FATF Recommendations. The evaluation identified several areas for improvement in Kenya’s AML/CFT system, including the supervision of DNFBPs (particularly real estate agents and lawyers), the effectiveness of financial intelligence analysis at the FRC, and the prosecution and conviction rates for money laundering offences. Kenya was placed under FATF’s enhanced follow-up process and has been implementing reforms to address the evaluation findings. The FRC has significantly stepped up DNFBP supervision and enforcement as a direct result of the FATF evaluation findings. Businesses operating in DNFBP categories should be aware that FRC inspection activity has increased substantially since 2022. For AML compliance advice, our regulatory team provides AML programme design and FRC inspection preparation services.

Record Keeping and Document Retention

The seven-year record retention requirement under POCAMLA is one of the most practically challenging aspects of FRC compliance for smaller businesses and professional practices. Records must be maintained in a retrievable form and must be available for production to the FRC within 30 days of a written request. Electronic records must be backed up and secured against unauthorised access or deletion. Reporting Institutions should implement a formal document retention policy that addresses how records are stored, who has access, how they are secured, and how they are disposed of at the end of the retention period. A well-documented record retention policy demonstrates to the FRC that the business takes its obligations seriously and reduces the administrative burden of responding to FRC information requests.

Emerging Digital Assets and FRC Reporting

The Financial Reporting Centre has confirmed that virtual asset service providers (VASPs) operating in Kenya are Reporting Institutions subject to POCAMLA, consistent with the FATF’s Recommendation 15 on virtual assets. VASPs include cryptocurrency exchanges, custodian wallet providers, and digital token issuers that transfer, exchange, or safeguard virtual assets on behalf of customers. VASPs must register with the FRC, implement AML/CFT programmes, and file STRs and CTRs as required. This brings crypto businesses within the same regulatory framework as traditional financial institutions for AML/CFT purposes, even in the absence of CBK or CMA licensing for their core business model. For cryptocurrency regulatory compliance and FRC registration, our team provides end-to-end advisory support for digital asset businesses.

FRC and the Kenya Financial Intelligence Unit

The Financial Reporting Centre serves as Kenya’s Financial Intelligence Unit (FIU), performing the functions that FATF Recommendation 29 requires all countries to establish. As an FIU, the FRC receives STRs and CTRs from Reporting Institutions, analyses financial intelligence to identify money laundering and terrorist financing patterns, and disseminates intelligence to law enforcement agencies including the DCI, DPP, and the Assets Recovery Agency. The FRC does not itself conduct investigations or prosecute offences; its role is intelligence analysis and dissemination. Reporting Institutions that file accurate, timely, and complete STRs are contributing to this intelligence-driven approach to AML/CFT, and the quality of their reporting directly affects the effectiveness of Kenya’s anti-financial crime efforts.

Obligations Under the Financial Reporting Centre Act

The Financial Reporting Centre Act 2012 (No. 5 of 2012) established the FRC as a statutory body with legal personality, the power to receive and analyse financial intelligence, and the authority to direct financial institutions to take specific AML/CFT actions. The FRC Act supplements POCAMLA and provides the detailed institutional framework for financial intelligence operations in Kenya. The FRC Act should be read alongside POCAMLA, the Proceeds of Crime and Anti-Money Laundering (Amendment) Act 2023, and the Counter Financing of Terrorism Act 2010 as the complete suite of Kenya’s primary AML/CFT legislation. All three Acts are available in full at kenyalaw.org.

Training and Staff Awareness Requirements

Reporting Institutions must provide regular AML/CFT training to all staff whose roles expose them to money laundering and terrorist financing risk. This includes front-line customer service staff who conduct account opening and transaction processing, compliance officers who administer the AML programme, and senior management who oversee the institution’s overall risk framework. Training programmes must cover the legal obligations of the institution under POCAMLA, the typologies and red flags relevant to the institution’s specific business and customer base, the institution’s internal AML/CFT policies and procedures, and the STR filing process including how to identify and assess suspicious activity. Training records must be maintained for at least seven years.

Risk-Based Approach to AML Compliance

POCAMLA and the FRC’s guidelines require Reporting Institutions to adopt a risk-based approach to AML/CFT compliance. Under a risk-based approach, the institution assesses the money laundering and terrorist financing risks associated with its specific business activities, customer types, products and services, and delivery channels, and then applies AML/CFT controls proportionate to those risks. Higher-risk customers receive Enhanced Due Diligence; lower-risk customers receive simplified monitoring. A risk-based approach allows Reporting Institutions to focus their compliance resources on the areas of greatest risk rather than applying uniform procedures to all customers regardless of their risk profile. The FRC expects all Reporting Institutions to document their risk assessment methodology and to update it at least annually or whenever there is a material change in the institution’s risk environment.

Consequences of FRC Non-Registration

Operating as a Reporting Institution without registering with the FRC is an offence under POCAMLA. The FRC has published a list of registered Reporting Institutions on its website at frc.go.ke, and unregistered entities that meet the definition of a Reporting Institution under POCAMLA’s Second Schedule are subject to FRC enforcement action. Consequences of non-registration include administrative penalties, referral to the relevant sector regulator (IRA, CBK, CMA, or LSK as applicable), and criminal prosecution of responsible officers. Businesses that are uncertain whether they qualify as Reporting Institutions should seek legal advice before concluding that registration is not required. Our regulatory compliance practice provides FRC registration advice and AML programme design for all DNFBP categories.

The FRC’s overall mandate, governance structure, and published AML/CFT guidelines are detailed on the Financial Reporting Centre’s official website at frc.go.ke. Businesses seeking to understand their obligations as Reporting Institutions, or requiring assistance with FRC registration and AML programme design, should engage legal counsel with specific experience in Kenya’s AML/CFT regulatory framework. Our regulatory compliance team provides end-to-end AML programme support, from initial FRC registration through to ongoing staff training, periodic compliance reviews, and FRC inspection preparation across all DNFBP categories regulated under POCAMLA.

Digital and non-deposit-taking credit providers face these AML reporting obligations in addition to their CBK licensing requirements. See our guide on digital credit provider licensing in Kenya for the current regime and the transition under way to the NDTCP framework.