Legal Notice 172 of 2026: The 24-Hour Asset Freeze and Reporting Duty for Banks, DNFBPs and VASPs

On 7 September 2026, the Cabinet Secretary for Interior and National Administration published the Prevention of Terrorism (Implementation of the United Nations Security Council Resolutions on Suppression of Terrorism) Regulations, 2026 as Legal Notice 172 of 2026 (Kenya Gazette Supplement No. 218). They replace the 2023 regulations and put hard clocks on anyone who holds funds or assets belonging to a designated person. This article sets out what the Regulations require, who they bind, and what the penalties are.

Who Legal Notice 172 binds

Regulation 2 defines a “reporting institution” as a financial institution, a designated non-financial business and profession, or a virtual asset service provider, as provided in section 2 of the Proceeds of Crime and Anti-Money Laundering Act. That takes in financial institutions, the businesses and professions designated under that Act, and licensed virtual asset providers. Whether a particular firm or business is designated is a question under that Act, not under these Regulations.

The freezing duty is wider than the reporting institution definition. Under regulation 9(1), on circulation of a sanctions list, “any person or entity holding funds or other assets” of a designated person must act. A reporting institution is the group with the additional duty to review the lists and monitor transactions on an ongoing basis, under regulation 36.

What “without delay” means: hours, not days

The Regulations define “without delay” as within a matter of hours of a designation by the UN Security Council or its Sanctions Committee, or by the Kenyan Counter Financing of Terrorism Inter-Ministerial Committee, and in any event not later than twenty-four hours of that designation. Regulation 10 requires the freezing and no-dealing duties to be carried out cumulatively and without delay. The Committee circulates UN lists to reporting institutions, supervisors and other holders of funds under regulation 7, and regulation 8 treats that circulation as authority for the holder to act.

The freezing duty

On circulation of a UN 1267 or 1988 list (regulation 9) or a domestic designation under Resolution 1373 (regulation 18), a holder of funds or assets must freeze, without prior notice:

1. all funds and other assets owned or controlled by the designated person or entity, not only those that can be tied to a particular terrorist act, plot or threat;
2. assets wholly or jointly owned or controlled, directly or indirectly, by them;
3. assets derived or generated from those assets; and
4. assets of a person or entity acting on their behalf or at their direction.

The holder must also not make funds, assets, economic resources or financial or related services available, as specified in section 30G of the Prevention of Terrorism Act. The wide sweep in the first item is the point to note: the freeze reaches everything the designated person owns or controls, and jointly held accounts are within it.

The 24-hour report, including attempted transactions

Under regulations 11(1) and 18(2), the person who froze assets must file a report with the Committee, through the Secretary, within twenty-four hours, specifying the assets frozen or the actions taken, and “including attempted transactions”. For a frozen account, regulation 11(2) requires the account number, the name of the holder, the time of freezing, the balance at that time, and any related accounts with their balances and the reason those accounts were identified as related. For other assets it requires a description, the owner’s name, the mode and date of acquisition, and the location.

The reference to attempted transactions means a compliance system has to capture and report an instruction that was refused or blocked, not only completed dealings.

Ongoing monitoring

Regulation 36(1) requires a reporting institution to regularly review the Domestic List and the sanctions lists and to monitor transactions involving listed persons and entities on an ongoing basis. Failure to do so is sanctionable under regulation 32(1). This is a standing screening obligation, and a business that screens clients only at onboarding will not, on the face of the regulation, meet it. See our guide to sanctions compliance for Kenyan businesses for how the lists are built and circulated.

Penalties

Regulation 32(1) applies where a specific penalty is not otherwise provided. On conviction, a natural person is liable to imprisonment for up to ten years, in accordance with section 50(4)(a) of the Act, or to a fine of up to KES 1 million. A legal person is liable to a fine of up to KES 20 million, in accordance with section 50(4)(b). Contravening regulation 9 is expressly made subject to regulation 32.

Protection, review and appeal

Regulation 34 provides that no proceedings lie against any person or entity, including a reporting institution, for anything done in good faith in compliance with the Regulations. A person aggrieved by a decision of the Committee may apply in writing for review within thirty working days, the Committee must decide within thirty working days, and a further appeal to the High Court lies within thirty working days of that decision (regulation 38). Regulation 39 revokes the 2023 regulations, L.N. No. 152 of 2023.

What to do now

1. Confirm whether your business is a reporting institution or otherwise holds funds or assets for others, and record who is responsible for sanctions alerts.
2. Check that alerts from the Committee can reach a named person outside office hours, given a window measured in hours.
3. Write a freezing procedure covering joint accounts, related accounts and the information regulation 11(2) requires in the report.
4. Make sure the system logs blocked or refused instructions, so that attempted transactions can be reported.
5. Move from onboarding-only screening to ongoing screening against the Domestic List and UN lists.
6. Retire any procedure that cites the 2023 regulations.