Customer due diligence gets most of the attention in Kenyan AML compliance, because it is the specific, documented obligation that falls on banks, designated professions and other reporting institutions. What gets overlooked is that the underlying money laundering offence does not only reach reporting institutions. It reaches anyone, including an ordinary business that never registered with the Financial Reporting Centre and never thought of itself as having AML obligations. For those businesses, supplier due diligence is the practical protection.
The offence that catches everyone, not just reporting institutions
Under section 3 of the Proceeds of Crime and Anti-Money Laundering Act, a person who knows, or who ought reasonably to have known, that property is or forms part of the proceeds of crime, and who enters into any agreement, arrangement or transaction with anyone in connection with that property, commits an offence. Section 4 separately makes it an offence to acquire, use or possess property where the person knew or ought reasonably to have known that it is or forms part of the proceeds of a crime. Neither section is limited to banks or designated professions. Both apply to a business paying a supplier, and the “ought reasonably to have known” standard means that deliberately not asking is a poor defence.
Section 16(1) sets the penalties. A natural person is liable to imprisonment for up to fourteen years, or a fine of up to KES 5 million or the value of the property involved, whichever is higher, or both. A body corporate is liable to a fine of up to KES 25 million. A company that never asks basic questions about who it is paying is not protected simply because nobody told it to check.
Why this is a real risk, not a theoretical one
Shell companies, invoice fraud and payments routed through intermediaries are not rare in commercial practice, and a business that pays a supplier without confirming who owns and controls it has no way of knowing whether it has become part of such a chain. Beyond the criminal exposure there is a simpler commercial risk. A supplier that turns out not to be who it claimed to be can leave a business with no recourse when a contract goes wrong, because there is no genuine, traceable counterparty behind the invoice.
What proportionate supplier due diligence looks like
This does not need to match the full customer due diligence a bank runs. For most businesses, a workable baseline covers four things:
- confirm the supplier is a genuinely registered entity, using a search of the company register;
- check who its directors are and, where practical, its beneficial owners;
- confirm that payment details match the registered entity rather than a third party; and
- apply closer scrutiny where a new supplier is unusually eager to be paid through an intermediary account or an unfamiliar payment route.
None of this requires specialist software for a typical SME. It requires a checklist that someone follows before a new supplier is onboarded, not after a payment has gone out.
A one-page supplier due diligence checklist
- Registration certificate and a current search result for the legal name.
- Names of directors and, where available, the ultimate owners.
- Physical address and a working contact who can be reached independently of the invoice.
- Tax compliance evidence appropriate to the contract.
- Bank account name matching the registered entity.
- Sign-off by someone other than the person who requested the supplier.
Where to apply more scrutiny
Higher-value contracts, suppliers introduced through a personal connection rather than a normal procurement process, and suppliers in cash-intensive or historically higher-risk sectors all warrant a closer look before the relationship starts. Warning signs include a request to change bank details shortly before payment, a supplier unwilling to provide registration documents, invoices that do not match the registered name, and pressure to pay urgently. The same logic that makes a bank apply enhanced due diligence to a higher-risk customer applies sensibly to a business choosing which suppliers to pay.
Keep a record of what you checked
Keep a short file for each new supplier showing the registration search, the people identified, the bank details verified and who approved onboarding. The statute asks what you knew or ought reasonably to have known, and a dated record of the questions you asked is the best evidence of the steps you took. It also helps if a payment is later disputed or a supplier turns out to be fraudulent.
How We Can Help
Clay & Associates Advocates helps businesses build proportionate supplier onboarding checklists, review high-risk vendor relationships before payment, and advise on what to do if a counterparty looks suspicious. If your business is itself a reporting institution, we can also document the AML programme the Act requires of you.
Frequently asked questions
Does my business have AML obligations if it is not a bank?
Not the formal reporting-institution duties, unless it falls within the Act’s definitions. But the offences in sections 3 and 4 apply to any person, so every business has an interest in knowing who it is dealing with.
What does “ought reasonably to have known” mean in practice?
It is an objective test. A business cannot rely on not having asked if a reasonable business in its position would have noticed warning signs.
Do I need to check every supplier?
Apply the checks in proportion to value and risk. A short baseline for every new supplier, and a closer review for higher-risk ones, is a sensible approach.
What should I do if a supplier looks suspicious?
Pause payment, preserve the documents and take advice before continuing. Whether a report is required depends on whether you are a reporting institution, and the position should be checked before you act.
Does paying through a bank make me safe?
No. A bank transfer shows where money went, not whether the recipient was legitimate. The offences in sections 3 and 4 turn on what you knew or ought reasonably to have known about the property, so the checks before payment still matter.
Sources: Proceeds of Crime and Anti-Money Laundering Act, sections 3, 4 and 16, Kenya Law.
