PSP AML, FRC and Data Protection Duties in Kenya

A payment service provider (PSP) in Kenya answers to three regulators at once: the Central Bank of Kenya (CBK) for the licence, the Financial Reporting Centre (FRC) for anti-money laundering, and the Office of the Data Protection Commissioner (ODPC) for personal data. Newly licensed providers can handle CBK carefully and then discover the other two registrations late. This article sets out the duties we have verified in the primary texts and shows how the draft National Payment System Bill, 2026 treats them.

What the payment law says about AML

Regulation 31 of the National Payment System Regulations, 2014 requires a PSP to use systems capable of screening transactions for compliance with the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA), the Prevention of Terrorism Act and related legislation. Regulation 60 adds that a PSP and its agents, cash merchants and wholesale cash merchants shall comply with those Acts and their associated regulations and guidelines. A CBK authorisation therefore does not displace the AML regime. It imports it.

Registering with the Financial Reporting Centre

POCAMLA defines a reporting institution as a financial institution, a designated non-financial business or profession, or a virtual asset service provider. Its definition of financial institution includes a person that, as a business, transfers funds or value by any means, or issues and manages means of payment including electronic money. A licensed PSP will usually fall within that wording, but test your own activities against the definition and do not assume.

Section 47A requires every reporting institution to register with the FRC within the period and in the manner the FRC prescribes, with the particulars it requires. The FRC keeps a register, the institution must notify it in writing of any change in its particulars within ninety days, and failing to register is an offence. Register early, because a licensed provider with live customers and no FRC registration is exposed. Our note on reporting to the Financial Reporting Centre covers the reporting side, and our guides on AML risk assessment for fintechs and sanctions compliance cover programme design.

Registering with the ODPC

The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 set mandatory registration thresholds in their Third Schedule. It lists purposes for which a controller or processor must register, and “provision of financial services” is one of them. Regulation 14 exempts a controller or processor from mandatory registration where it has annual turnover or revenue below KES 5 million and fewer than ten employees. Both conditions must hold for the exemption. The Second Schedule sets fees and shows renewal after every two years.

A PSP processes identity, transaction and device data at scale, so assume registration is required and confirm any exemption claim against the regulation. Registration is separate from the DPA duties that follow, such as security, breach notification and cross-border transfer controls, which our note on cross-border data transfer compliance explains.

How the 2026 Bill treats AML

The draft Bill, on which comments closed on 9 October 2026, moves AML into the payment statute itself:

• Clause 19(1) requires every person subject to the Act to comply with POCAMLA provisions on AML, combating the financing of terrorism and countering proliferation financing.
• Clause 19(2) lets CBK certify the fitness of proposed significant shareholders, beneficial owners, directors and senior officers, inspect on site and off site, supervise a group on a consolidated basis, compel documents and issue AML rules and instructions.
• Clause 19(3) provides that a violation of POCAMLA in relation to a licensed activity attracts, for a legal person, a penalty of up to KES 20 million, in addition to other penalties under other written law.
• Clause 52 requires payment information to be retrievable without delay by CBK, the FRC and law enforcement.

The practical effect is that CBK would become a direct AML supervisor with its own sanctions, so a weak AML programme could put the licence itself at risk and not only attract FRC attention.

Common gaps

Three gaps are easy to fall into. The first is treating the CBK licence as the end of the process, so the FRC and ODPC registrations are never made. The second is an agent network onboarded without AML terms, even though Regulation 60 binds agents and cash merchants directly. The third is a transaction screening tool that is never tuned to the provider’s own risk assessment. Each is easy to fix before an inspection and expensive to fix after one.

A compliance sequence that works

• Appoint a senior person responsible for AML before launch and document the appointment.
• Complete a written AML and sanctions risk assessment, then build screening to match (Regulation 31).
• Register with the FRC and the ODPC, and diarise the 90-day change notice and the ODPC renewal.
• Extend AML duties by contract to agents and cash merchants, since Regulation 60 binds them too.
• Keep records for at least seven years (Regulation 29(1)), which also serves AML retrieval duties.

Frequently asked questions

This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.