Pricing
Language
Published 26-05-2026 · Updated 26-05-2026

Kenya AML/CFT and Targeted Financial Sanctions Screening Guide

Understand Kenya's FRC, goAML reporting, TFS lists, screening workflow, and evidence requirements.

Share

Kenya AML/CFT and Targeted Financial Sanctions Screening Guide

Kenya's AML/CFT and targeted financial sanctions framework is centred on the Financial Reporting Centre (FRC), sector supervisors, goAML reporting, and targeted financial sanctions notices. For compliance teams, the practical question is not only "which sanctions list should we screen?" It is how to classify the institution, screen the right people and companies, handle possible matches, report through the right channel, and keep evidence that stands up in a review.

For Kenya-based reporting institutions, the strongest baseline is Kenya's own legal and operational framework: the Proceeds of Crime and Anti-Money Laundering Act, the 2023 AML regulations, FRC guidance, the Kenya domestic targeted financial sanctions list, and UN-linked sanctions regimes implemented through Kenya's targeted-financial-sanctions process.

Quick Answer

QuestionShort answer
Who is Kenya's financial intelligence unit?The Financial Reporting Centre (FRC).
Where are suspicious activity reports filed?Through goAML, after FRC registration.
Does Kenya have a public domestic sanctions list?Yes. FRC links to Domestic List Kenya under the domestic TFS regime.
What is the core sanctions baseline?Kenya's domestic TFS list plus UN-linked TFS regimes implemented through Kenya's framework.
Is there a public filing API?Kenya's public materials support goAML portal reporting and XML upload. They do not identify a public Kenya-specific REST or SOAP API for sanctions or STR filing.
Is the TFS report template the same as goAML?No. goAML is the STR/SAR reporting workflow; the TFS template is for sanctions-freezing returns where the relevant FRC/CFTIMC notice requires it.
How long should evidence be retained?At least seven years for key AML records under Kenya's 2023 AML regulations.

Why This Matters in Kenya

Kenya uses a multi-authority model. The FRC is Kenya's financial intelligence unit and, according to its compliance page, the AML/CFT/CPF supervisor of all reporting institutions. Sector supervisors still matter: banks and payment firms sit under the Central Bank of Kenya, capital-market firms under the Capital Markets Authority, insurance firms under the Insurance Regulatory Authority, pensions under the Retirement Benefits Authority, SACCOs under SASRA, and DNFBPs under their own supervisory bodies.

That structure changes the operating model. A bank, money remitter, payment service provider, insurer, broker, real-estate agency, casino, accountant, company-service provider, or law firm may all be "reporting institutions," but their supervisor, customer data, risk indicators, and escalation route can differ.

2 days
STR/SAR reporting clock

FRC's compliance page says suspicious activities or transactions indicating possible ML, TF, or PF should be reported to the Centre within two days after suspicion arose.

20h + TFS notice
TFS reporting windows

An FRC circular refers to a twenty-hour STR after detecting and freezing funds. Separate TFS template or nil-return timing should follow the relevant FRC/CFTIMC notice.

7 years
AML recordkeeping period

Kenya's 2023 AML regulations set a minimum seven-year recordkeeping period for key CDD, transaction, and unusual-activity analysis records.

The screening perimeter should be precise: Kenya has a public domestic targeted financial sanctions list and UN-linked TFS obligations; OFAC, EU, UK, and other foreign lists are usually risk-based extensions unless a direct legal, banking, contractual, or group-policy nexus applies.

Kenya Is a Multi-Authority Model

Kenya should not be treated as a single-list or single-regulator screening environment. The FRC is central, but operating obligations sit across the FRC, the CFT Inter-Ministerial Committee, and sector supervisors.

AuthorityRolePractical relevance
Financial Reporting CentreKenya's financial intelligence unit and AML/CFT/CPF supervisor across reporting institutions.Registration and reporting are done through goAML, and FRC receives suspicious activity, cash transaction, and other reports.
CFT Inter-Ministerial Committee / FRC TFS channelOperational route for targeted financial sanctions notices and Kenya's domestic TFS list.Relevant for TFS list updates, freezing expectations, report templates, false-positive material, and access-to-frozen-funds forms.
Central Bank of KenyaSector supervisor for banks, microfinance institutions, forex bureaus, money remitters, digital credit providers, and payment service providers listed by FRC.Important for payment, banking, fintech, and money-transfer screening controls.
Capital Markets AuthoritySector supervisor for securities, investment, fund-management, and capital-market institutions.Screening should cover investors, clients, beneficial owners, issuers, counterparties, and transactions.
Insurance Regulatory AuthoritySector supervisor for life insurance providers, brokers, and agents.Screening should cover policyholders, beneficiaries, payees, and beneficial owners.
Retirement Benefits Authority and SASRASector supervisors for retirement-benefits managers and SACCOs.Screening and monitoring should reflect the institution's product and member/customer model.
DNFBP supervisorsSupervisory bodies for real estate, casinos, accountants, company-service providers, legal professionals, and dealers in precious metals or stones, as mapped through FRC's reporting-institution guidance.Beneficial-owner capture, suspicious-activity escalation, and evidence retention are often more important than simple customer-name screening.

This authority map matters for product and operations teams. A Kenya-ready workflow should store the institution type, supervisor, list policy, reporting route, and decision evidence, not just the screening result.

Who Must Comply

FRC's compliance page describes reporting institutions as financial institutions and designated non-financial businesses and professions under POCAMLA. The listed sectors include banks, microfinance institutions, forex bureaus, money remittance service providers, digital credit providers, payment service providers, capital-market firms, life insurance firms, retirement-benefits fund managers, SACCOs, real-estate agencies, casinos, precious-metal and precious-stone dealers, accountants, trust and company service providers, and legal professionals.

SectorMain supervisor or routeScreening implication
Banks and payment firmsCBK / FRC / goAML.Screen customers, beneficial owners, signatories, originators, beneficiaries, counterparties, and payment parties.
Money remitters and forex firmsCBK / FRC / goAML.Strong identifier quality matters because payments and remittances create transaction-stage screening obligations.
Digital credit and fintechCBK / FRC today; VASP rules are evolving.Treat customer, device, wallet, account, and repayment-party data as part of the monitoring perimeter where relevant.
Capital marketsCMA / FRC / goAML.Screen investors, clients, issuers, beneficial owners, intermediaries, and high-risk transaction activity.
InsuranceIRA / FRC / goAML.Screen policyholders, beneficiaries, payees, and ownership/control persons.
Real estate and DNFBPsSector supervisor / FRC / goAML.Build a practical beneficial-owner and source-of-funds workflow, not only a list-search widget.

Kenya's virtual-asset framework is moving quickly. Treasury materials refer to the Virtual Asset Service Providers Act, 2025 and draft 2026 implementing regulations. VASP controls should therefore be checked against the latest Treasury, CBK, CMA, and FRC guidance before being turned into internal policy or product claims.

The Kenya TFS Baseline

Kenya's targeted financial sanctions baseline has two visible parts in FRC materials.

First, FRC's Targeted Financial Sanctions page identifies UN-linked regimes, including ISIL (Da'esh) and Al-Qaida, Taliban-related listings, DPRK, and Iran-related regimes. It also explains targeted financial sanctions as asset freezing without delay and prohibitions on making funds or other assets available to designated persons or entities.

Second, Kenya has a domestic TFS regime. FRC explains that the Counter Financing of Terrorism Inter-Ministerial Committee compiles a Domestic List for individuals and entities that meet the UNSCR 1373 designation criteria. FRC links to Domestic List Kenya, report templates, false-positive material, and access-to-frozen-funds forms.

That matters operationally. FRC materials show a public domestic list file through Kenya's TFS infrastructure, so a Kenya screening policy should treat the domestic list as a local source to consume and monitor.

Which Lists to Screen in Kenya

List coverage should be written as a policy decision with legal and risk layers.

SourcePractical role in KenyaHow to frame it
Domestic List KenyaKenya's public domestic TFS source in FRC materials.Local Kenya TFS baseline.
FRC TFS noticesOperational notices for UN-linked and domestic TFS changes, with report templates.Monitor continuously and keep source evidence.
UN Security Council Consolidated ListCore UN sanctions source behind Kenya's UN-linked TFS implementation.Kenya-facing baseline for UN-linked TFS screening.
OFAC sanctions listsImportant for USD, U.S. persons, U.S. nexus, correspondent banking, investors, contracts, or group policy.Risk-based extension unless a direct nexus makes it mandatory.
EU financial sanctions dataImportant for EU ownership, euro flows, EU customers, contracts, or group policy.Risk-based extension for EU exposure.
UK Sanctions ListImportant for UK nexus, sterling exposure, UK customers, counterparties, or group policy.Risk-based extension for UK exposure.

Kenya sanctions screening is not simply "screen every global list and call it done." A defensible policy starts with Kenya's domestic and UN-linked TFS sources, then adds foreign lists based on business exposure and documented risk rationale.

Indicators Worth Escalating

FRC guidance and typology materials are useful because they connect list screening to real customer behaviour. For an MLRO, the strongest cases usually combine a list signal with context: geography, role, ownership, payment pattern, source of funds, or missing commercial rationale.

AreaExamples that should raise attention
Sanctions and TFSCustomer, representative, beneficial owner, account holder, payee, or counterparty appears on Kenya's domestic list, a UN list, or another list included in the institution's policy.
Money remittance and paymentsFunds move to or from higher-risk jurisdictions without a clear explanation, or digital payment channels are used in a way that does not fit the customer profile.
Real estateUnusual cash behaviour, unclear source of funds, high-risk geography, or parties linked to sanctions, embargoes, or similar measures.
Legal, trust, and company servicesUse of client or escrow accounts without a clear underlying transaction, complex structures without commercial rationale, nominee parties, secrecy-jurisdiction links, or pressure to bypass normal checks.
Virtual assetsWallet or platform activity linked to scams, fake exchanges, cloud-mining schemes, phishing, fake ICOs, or flows that bypass regulated VASPs.

These indicators should not be treated as automatic proof. They are escalation signals. The MLRO still needs to review the facts, document the reasoning, and decide whether the case is a false positive, potential match, confirmed TFS hit, or ML/TF/PF suspicion.

A Practical Kenya Screening Workflow

Screening should operate as a decision workflow, not a single database query.

  1. 01

    Classify the institution and activity

    Identify whether the business is a bank, payment firm, money remitter, insurer, capital-market institution, SACCO, VASP, real-estate agency, casino, accountant, company-service provider, legal professional, or another reporting institution.

  2. 02

    Screen the right parties and identifiers

    Screen customers, beneficial owners, directors, signatories, counterparties, originators, beneficiaries, payees, wallets, vessels, and other relevant parties against Kenya's baseline and risk-based foreign lists.

  3. 03

    Escalate, report, and retain evidence

    Separate false positives, unresolved matches, confirmed TFS hits, and non-sanctions ML/TF/PF suspicion. Route reports through goAML or the TFS channel and keep a full decision record.

A good Kenya policy should answer these questions:

  • which reporting-institution category applies;
  • which supervisor and reporting channel are relevant;
  • which TFS and risk-based lists are screened;
  • which parties are screened at onboarding and during the relationship;
  • what identifiers are required to clear or confirm a match;
  • what happens when a TFS hit is confirmed;
  • when an STR/SAR should be filed through goAML;
  • what evidence is retained and for how long.

How to Review Matches

A screening alert is not automatically a confirmed match. Reviewers should compare all available identifiers, including full names, aliases, date of birth, nationality, national ID, passport, address, registration data, ownership and control data, account data, transaction role, and source-list details.

OutcomeMeaningOperational response
False positiveThe customer, owner, counterparty, or transaction party is not the listed person or entity.Document the identifier comparison, source list, reviewer, rationale, and final decision.
Potential matchThe alert cannot yet be cleared with available information.Escalate to compliance or the MLRO, gather lawful clarifying information, avoid tipping off, and keep the case open until resolved.
Confirmed TFS matchThe party is confirmed as a designated person or entity under a Kenya-relevant TFS source.Freeze without delay and without prior notice, avoid making funds or services available, file the required STR and TFS report, and preserve evidence.
ML/TF/PF suspicionFacts indicate possible money laundering, terrorist financing, or proliferation financing even without a confirmed sanctions match.File the appropriate report through goAML within the applicable Kenya timeline and retain supporting documents.

The confirmed TFS scenario has the clearest operational steps. An FRC circular instructs reporting institutions to freeze without delay and without prior notice, and to file an STR with the Centre within twenty hours of detecting and freezing funds. The separate TFS report-template or nil-return timing should follow the relevant FRC/CFTIMC notice and template instructions, including tfs@frc.go.ke where the notice requires that route.

How Suspicious Activity Is Reported

FRC's compliance page says registration with the Centre is done solely through goAML. It also says suspicious transaction/activity reports are automated through goAML. STR/SAR and the main reports described on FRC's compliance page are routed through goAML, while TFS notices may prescribe a separate template or email route.

MLRO Workflow

For an MLRO, the practical workflow starts before goAML submission. FRC sector guidance says staff should disclose suspicious activity or suspicious transactions to the MLRO. The MLRO should then examine the background and purpose of the activity, document the findings, decide whether suspicion of ML/TF/PF exists, and file the SAR or STR with FRC where the threshold is met.

MLRO stepWhat to do
Receive the internal disclosureCapture who raised the concern, the customer or transaction involved, the trigger, and any urgent risk such as a possible TFS match.
Examine and documentReview the customer profile, transaction history, source of funds, declared purpose, counterparties, geography, ownership/control, and sanctions-screening results.
Decide whether suspicion existsRecord why the case is reportable, why it is not reportable, or why more information is needed.
File through goAMLSubmit the SAR, STR, or combined activity/transaction report through goAML within the applicable Kenya timeline.
Preserve and monitorKeep the case file, attachments, transmission evidence, follow-up requests, and any later activity linked to the same customer or counterparty.

Kenyan materials use slightly different report labels in different places. FRC's compliance page uses STR/SAR. Some sector guidance distinguishes suspicious activity reports, suspicious transaction reports, and combined activity-and-transaction reports. The safest operating rule is to follow the terminology and format used in the relevant FRC channel and sector guidance.

What a Good STR/SAR Should Contain

FRC guidance is clear that a useful suspicious report needs more than a short alert note. The report should explain the nature and reason for suspicion and include supporting documents where available.

Evidence areaUseful content for the report
Customer identifiersName, aliases, nationality, ID or passport, date of birth, registration data, directors, shareholders, beneficial owners, nominee parties, occupation or business, and relationship start date.
Role in the caseWhether the party is the customer, beneficial owner, representative, originator, beneficiary, counterparty, payee, or another relevant actor.
Transaction or activity detailsDate, amount, currency, product or service, declared purpose, source of funds, origin or destination country, account or wallet details, and transaction pattern.
Suspicion narrativeWhy the activity is unusual, inconsistent, linked to higher-risk geography, connected to a sanctions alert, or otherwise suspicious for ML, TF, or PF.
Supporting documentsKYC/onboarding forms, CDD or EDD records, transaction records, bank slips, receipts, agreements, invoices, correspondence, screening results, and previous review notes.

An MLRO should also plan for follow-up. FRC may request additional information after a report is filed, so the case file should be organized enough to answer questions quickly.

For compliance operations, the practical route is:

  1. Register the reporting institution in goAML and receive the organisation number.
  2. Configure the MLRO/compliance escalation workflow internally.
  3. Capture the suspicious activity, transaction context, customer data, beneficial-owner data, supporting documents, and rationale.
  4. File the STR/SAR through goAML when suspicion of ML, TF, or PF arises.
  5. If the case is a confirmed TFS hit, also follow the TFS report route and template communicated through FRC/CFTIMC notices.
  6. Keep the report, source data, list version, case review, reviewer decision, and transmission evidence.

goAML vs the TFS Report Template

Kenya's goAML route and the FRC/CFTIMC TFS report template are not the same thing.

Reporting itemWhat it is forPractical use
goAML STR/SARSuspicious activity or transaction reporting for possible money laundering, terrorist financing, or proliferation financing.File through FRC's goAML portal when suspicion arises, using the institution's internal escalation and MLRO workflow.
TFS report templateTargeted financial sanctions reporting after funds, accounts, assets, or property linked to a designated person or entity have been detected and frozen.Use the official template published in the FRC TFS materials to report the institution, submitter, designated party, sanctions regime, frozen assets, account/reference numbers, value, balance at freezing, and other relevant information.

The TFS template is not a replacement for goAML. A confirmed TFS hit may require the sanctions-specific template route and, where the facts also create ML/TF/PF suspicion or the applicable notice requires it, an STR/SAR through goAML.

There is also a technical distinction. Kenya's public materials support goAML portal reporting and XML upload. They do not identify a public Kenya-specific REST or SOAP API for sanctions or STR filing.

Other FRC Reports MLROs Should Not Confuse

An MLRO should separate suspicious reporting from other FRC reporting routes. The trigger, timing, and channel are not the same.

Report or channelTriggerRoute and timing
STR / SARSuspicion of ML, TF, PF, criminal proceeds, or related suspicious activity.goAML, within two days after suspicion arose.
TFS report templateFunds, accounts, assets, or property linked to a designated person or entity have been detected and frozen, or a TFS notice requires a return.FRC/CFTIMC template route, including tfs@frc.go.ke where the notice requires it. Some TFS notices also require nil returns within the notice-specific timing.
Cash Transaction ReportCash transaction equivalent to or exceeding USD 15,000, whether suspicious or not.Electronic filing through goAML or another FRC-prescribed route, generally by the end of the relevant week unless immediate reporting is required.
Cross-border monetary declarationMonetary instruments equivalent to or exceeding USD 10,000 entering or leaving Kenya.Declaration to Customs before entry or exit; Customs forwards the declaration to FRC.
Higher-risk-country reportAnnual list of customers originating from higher-risk countries.Submitted to FRC by 31 January for the preceding calendar year.

This distinction matters in product and process design. A TFS template return, a suspicious report, a CTR, and a higher-risk-country return should not be forced into one generic "case closed" workflow.

Evidence and Audit Trail

Kenya's 2023 AML regulations require reporting institutions to retain key records for a minimum of seven years. For screening teams, that means keeping a usable case file with the data, source lists, review notes, decision, and filing evidence.

Evidence areaWhat to keep
Institution classificationWhy the firm was treated as a bank, payment firm, insurer, capital-market institution, DNFBP, VASP, or another reporting institution.
List policyWhich Kenya domestic, UN-linked, and foreign risk-based lists were screened, plus the legal or business rationale.
Input dataNames, aliases, ID numbers, passports, dates of birth, nationalities, addresses, registration numbers, beneficial owners, account details, wallet addresses, and transaction roles.
Match reviewCandidate records, identifiers compared, false-positive rationale, escalation notes, and final decision.
Reporting decisionWhether the case triggered goAML reporting, a TFS freeze/report workflow, enhanced monitoring, or no report.
Retention recordCase ID, reviewer, date, source files, list version or refresh timestamp, attachments, and retention horizon.

This is where workflow quality matters. "No match" and "cleared" are weak evidence on their own. A review file should explain why the case was cleared, escalated, frozen, reported, or retained.

Kenya AML/CFT and TFS Screening Checklist

  • Classify the business and activity under the correct Kenya reporting-institution category.
  • Map the supervisor and reporting route before writing the screening policy.
  • Screen Kenya's domestic TFS list and UN-linked TFS sources as the local baseline.
  • Monitor FRC TFS notices and keep evidence of list updates.
  • Add OFAC, EU, UK, and other foreign lists where business exposure justifies them.
  • Screen beneficial owners, directors, signatories, beneficiaries, originators, payees, counterparties, and other relevant parties.
  • Use identifiers beyond names: date of birth, ID, passport, address, registration number, ownership/control data, account data, transaction role, and source-list details.
  • Escalate unresolved alerts to compliance or the MLRO.
  • Freeze confirmed TFS matches without delay and without prior notice.
  • File STR/SAR reports through goAML when suspicion arises.
  • Use the TFS report template and tfs@frc.go.ke route where FRC/CFTIMC notices require it.
  • Retain evidence for at least seven years, or longer if the firm's internal policy or another legal requirement applies.
  • Document goAML portal reporting and XML upload; do not assume a public Kenya filing API unless FRC confirms one.

How Checklynx Supports the Workflow

Checklynx helps Kenya-facing teams run sanctions and AML screening as a controlled workflow. Teams can screen customers and counterparties against global sanctions lists and Kenya-specific sources, including Kenya's domestic TFS list for terrorism-related designations published through the FRC/CFTIMC framework. They can compare identifiers, review alerts, monitor list changes, run batch screening and ongoing monitoring, and preserve why a case was cleared, escalated, frozen, reported, or retained.

That matters in Kenya because a reporting institution may need one workflow that combines the Kenya domestic list, UN-linked sanctions data, OFAC, EU, UK, and other global lists, beneficial-owner data, transaction context, goAML reporting evidence, and FRC/CFTIMC TFS templates.

For teams that need scalable reporting, Checklynx can help prepare structured screening evidence, investigation notes, and supporting data that MLROs can use when filing reports through the FRC goAML workflow. It can also help keep XML upload preparation and TFS report-template evidence consistent with the underlying screening case, source lists, reviewer decisions, and attachments.

Build a Kenya-ready screening workflow

Use Checklynx to screen customers and counterparties, manage alert review, monitor list updates, and retain evidence for AML/CFT and TFS teams.

Case managementAudit evidenceTalk to Checklynx

FAQ

What is Kenya's financial intelligence unit?

Kenya's financial intelligence unit is the Financial Reporting Centre. FRC receives, analyses, and disseminates financial intelligence and is central to Kenya's AML/CFT/CPF reporting workflow.

Where are suspicious activity reports filed in Kenya?

Suspicious activity and transaction reports are filed through goAML after the reporting institution has registered with FRC.

How fast must suspicious activity be reported in Kenya?

FRC's compliance page says suspicious activities or transactions indicating possible ML, TF, or PF should be reported within two days after the suspicion arose.

Does Kenya have a public domestic sanctions list?

Yes. FRC's targeted financial sanctions page links to a public Domestic List Kenya under the domestic TFS regime connected to UNSCR 1373.

Which sanctions lists should a Kenya-based firm screen?

Start with Kenya's domestic TFS list and UN-linked TFS sources implemented through Kenya's framework. Add OFAC, EU, UK, and other foreign lists where customer geography, currency, correspondent banking, investor requirements, contracts, or group policy create exposure.

What happens after a confirmed TFS match?

The route described in FRC materials is to freeze without delay and without prior notice, avoid making funds or services available, file the required STR with the Centre, and submit the TFS report or nil return through the FRC/CFTIMC template route where the relevant notice requires it.

Is there a public Kenya API for STR or sanctions filing?

Kenya's public materials support goAML portal reporting and XML upload. They do not identify a public Kenya-specific REST or SOAP API for sanctions or STR filing.

Does goAML support XML?

Yes. goAML materials support structured web-form reporting and XML upload. That is useful for scalable reporting preparation, but XML upload should not be described as a public API.

How long should Kenya screening evidence be kept?

Kenya's 2023 AML regulations set a minimum seven-year recordkeeping period for key AML records. Screening evidence should be retained consistently with that period and with any stricter sector or internal policy.

Should beneficial owners be screened?

Yes. Kenya's 2023 AML regulations require customer due diligence, beneficial-owner identification and verification, and ongoing monitoring. Screening only the named customer is too narrow for a defensible program.

Official Sources Explained

Last reviewed: 26 May 2026.

Share
knowledge base

Footer

Start your journey today!

Don't risk compliance, stay ahead.

Kenya AML/CFT and Targeted Financial Sanctions Screening