Africa Fintech Regulatory Atlas · Kenya

Kenya's grey-list years: the AML and data protection evidence fintechs must be able to show

Kenya has been under FATF increased monitoring since February 2024, and the June 2026 plenary kept it there. For a fintech, that means supervisors and banking partners are looking harder at how anti-money laundering controls work in practice, not only on paper. At the same time the Data Commissioner registers, investigates and fines under the Data Protection Act. This guide sets out who is in scope of each regime, what the law requires, and how to produce the evidence that shows it.

Last reviewed: 11 October 2026 · Next review: 9 January 2027 · Written by Oluwafemi Ofobutu, founder

This guide is general information, not legal advice. The official text is the authority. Local legal interpretation should come from qualified counsel in Kenya.

Verification status, 11 October 2026: all 63 statements in our claims ledger were matched automatically against the official text before publication. 37 are re-checked on every build against government-hosted copies and the FATF; the other 26 cite Kenya Law, which now blocks automated checks from our build servers, so the StackWeaver compliance research team re-checks them by hand.

Executive summary

Sourced

  • The grey list is still on. The FATF kept Kenya under increased monitoring in June 2026 and expects it to keep implementing its action plan (FATF, June 2026). Two of the seven action items land directly on fintechs: risk-based supervision of financial institutions, and better use of preventive measures, "including to increase STR filing" (action item 2).
  • Most fintechs are reporting institutions. The anti-money laundering law covers financial institutions and, explicitly, virtual asset service providers (POCAMLA s. 2). They must report suspicions within two days (s. 44(2)), keep records for at least seven years (s. 46) and register with the Financial Reporting Centre (s. 47A).
  • Financial services cannot skip ODPC registration. The small-business exemption from registration does not apply to purposes in the Third Schedule (reg. 4(4)), and that schedule lists the provision of financial services (Third Schedule).
  • Two clocks matter in an incident. A breach with a real risk of harm goes to the Data Commissioner within 72 hours of becoming aware (DPA s. 43); a suspicious transaction goes to the Centre within two days of the suspicion. Run both in one incident playbook.
  • Crypto is now in the perimeter. The Virtual Asset Service Providers Act, 2025 commenced on 4 November 2025 (VASP Act) with the Capital Markets Authority and the Central Bank of Kenya as regulatory authorities (CBK and CMA notice).

Who is in scope

Sourced, with our reading marked

Kenya regulates a fintech through two separate statutes, and most fintechs are inside both. The Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) places its duties on "reporting institutions", which it defines as financial institutions, designated non-financial businesses and professions, and virtual asset service providers (s. 2). Each reporting institution answers to a supervisory body. The First Schedule names them, including the Central Bank of Kenya, the Capital Markets Authority, the Insurance Regulatory Authority, the Retirement Benefits Authority and the Sacco Societies Regulatory Authority (First Schedule).

The Data Protection Act applies to anyone acting as a data controller or data processor, and no one may act in either role unless registered with the Data Commissioner (s. 18(1)). The registration regulations exempt very small organisations: those with annual turnover or revenue below KES 5 million and fewer than ten employees (reg. 4(2)). That exemption is switched off for anyone processing personal data for the purposes in the Third Schedule (reg. 4(4)), and item 8 of that schedule is the provision of financial services (Third Schedule).

StackWeaver view · Put together, a licensed payment service provider, digital lender, wallet, remittance business, investment app or virtual asset business should assume it is both a reporting institution and a registrable data controller, whatever its size. The exceptions are narrow, so write your scoping decision down, cite the licence it rests on, and keep it in your evidence pack.

Technology vendors are usually processors rather than reporting institutions. A cloud, KYC or core-banking provider serving Kenyan fintechs still needs ODPC registration and is pulled into its clients' breach duties: a processor must tell the controller about a breach without delay and, where reasonably practicable, within 48 hours (s. 43(3)).

The regulators

Sourced

The Financial Reporting Centre (FRC). The Centre is established under section 21 of POCAMLA (s. 2). It receives suspicious transaction reports and cash transaction reports, keeps the register of reporting institutions (s. 47A) and disseminates the list of higher-risk countries that triggers enhanced due diligence (s. 45A).

Your supervisory body. Supervision of AML/CFT compliance sits with the body named for your sector in the First Schedule (First Schedule). For most fintechs that is the Central Bank of Kenya or the Capital Markets Authority; for virtual asset service providers, the VASP Act names both as regulatory authorities (CBK and CMA notice).

The Office of the Data Protection Commissioner (ODPC). The Data Commissioner registers controllers and processors, receives breach notifications and impact assessments, and investigates complaints. At the end of an investigation the Commissioner makes a determination under Regulation 14 of the enforcement regulations, and the ODPC publishes its determinations by year (ODPC determinations). Anyone subject to an administrative action can appeal to the High Court (s. 64).

The FATF and ESAAMLG. Kenya made its high-level political commitment to work with the FATF and the Eastern and Southern Africa Anti-Money Laundering Group in February 2024 (FATF). Their plenary statements are the best public signal of where supervisory pressure will fall next.

Obligations and the evidence that demonstrates them

Sourced obligations · evidence column is StackWeaver view

The table lists each obligation, its legal source, who it applies to, the evidence that shows it is met, and its deadline. The legal-source column links to the official text; the evidence column is our practical suggestion.

Kenya AML and data protection obligations for fintechs
Obligation Legal source Applies to Evidence Deadline
Report suspicious or unusual transactions and activities, including attempted ones, to the Financial Reporting Centre. POCAMLA s. 44(2)–(3) Reporting institutions: financial institutions and virtual asset service providers STR log with suspicion date, filing date and reference; escalation records from staff to the MLRO Within two days after the suspicion arose
File reports on all cash transactions above the threshold in the Fourth Schedule, whether or not they look suspicious. POCAMLA s. 44(6), Fourth Schedule Reporting institutions that handle cash Cash transaction report extracts reconciled to the ledger As each reportable transaction occurs
Identify and verify customers and applicants before entering a relationship or transaction, and know the beneficial owner. POCAMLA s. 45(1); 2023 Regulations reg. 2 Reporting institutions KYC files, beneficial-ownership records, screening results Before onboarding; refreshed on risk triggers
Apply enhanced due diligence to business with higher-risk countries, and report it to the Centre each year. POCAMLA s. 45A Reporting institutions with cross-border customers or counterparties Country-risk list, EDD files, annual return to the Centre Ongoing; annual report
For foreign politically exposed persons, get senior management approval and establish the source of wealth and funds. 2023 Regulations reg. 26 Reporting institutions PEP screening logs and signed approvals Before establishing the relationship
Keep records of all transactions and identity evidence, and the written findings on unusual transactions. POCAMLA s. 44(5), s. 46 Reporting institutions Retention schedule for AML records; retrieval test results At least seven years
Run internal controls and internal reporting procedures, appoint a management-level MLRO, and register with the Centre. POCAMLA ss. 47, 47A; 2023 Regulations reg. 12 Reporting institutions AML policy, MLRO appointment letter, FRC registration confirmation Ongoing; registration as the Centre prescribes
Document an ML/TF/PF risk assessment, assess new products and technologies before launch, and update the programme at least every two years. 2023 Regulations regs. 7–8 Reporting institutions Board-approved risk assessment; product-launch risk assessments Before launch; review at least every two years
Register with the Data Commissioner before acting as a data controller or processor; renew before the certificate expires. DPA s. 18; Registration Regulations regs. 4, 9, Third Schedule Controllers and processors; financial services firms regardless of size ODPC registration certificate with expiry date Before processing; certificate valid 24 months
Process personal data only on a lawful basis, prove consent where you rely on it, and get express consent for commercial use. DPA ss. 30, 32, 37 Controllers Lawful-basis register; consent records; marketing consent logs Ongoing
Carry out a data protection impact assessment before high-risk processing and submit the report to the Data Commissioner. DPA s. 31 Controllers and processors with high-risk processing DPIA reports and ODPC submission receipts 60 days before the processing starts
Honour data subject rights, including access, objection, correction, deletion and portability. DPA ss. 26, 38 Controllers (processors assist) Request log with response dates Portability within 30 days
Keep personal data only as long as needed, under a written retention schedule. DPA s. 39; General Regulations reg. 19 Controllers and processors Retention schedule reconciled with the AML record-keeping period; deletion logs Ongoing
Notify the Data Commissioner of a breach that creates a real risk of harm, and tell affected people in writing. DPA s. 43 Controllers; processors notify the controller Breach register, timed notifications, incident tabletop records 72 hours to the Commissioner; processors 48 hours where practicable
Transfer personal data out of Kenya only with proof of appropriate safeguards or another condition in the Act; check for localisation rules. DPA ss. 25(h), 48, 50; General Regulations reg. 26 Controllers and processors using foreign cloud or vendors Transfer register, safeguard documents, hosting-location map Before the transfer

Three obligations deserve more detail because fintechs most often underestimate them. First, the two-day reporting clock runs from when the suspicion arose, not from when an analyst finished reviewing the alert (s. 44(2)). Attempted transactions count (s. 44(3)), and the institution must examine the background and purpose of the activity, write its findings down and keep them for at least seven years (s. 44(5)). An alert queue that ages for a week before triage fails the law even if the report is eventually filed.

Second, the risk assessment is a living document. The 2023 Regulations require every reporting institution to undertake a documented ML/TF/PF risk assessment (reg. 7(1)), to update its policies or programmes at least once every two years (reg. 7(5)), and to assess risk before introducing a new product, business practice or technology (reg. 8(2)). For a fintech that ships features monthly, the product-launch assessment is where most gaps appear.

Third, the data protection impact assessment has a lead time. Where processing is likely to be high risk, the assessment must be done before processing (s. 31(1)), and section 31(5) says the report shall be submitted 60 days before the processing begins (s. 31(5)). Credit-scoring models, biometric onboarding and large-scale profiling should be planned with that window built in.

Timeline of key dates

Sourced; derived dates are marked as our reading

  1. Data Protection Act commences (assented 8 November 2019) · source

  2. Data Protection (General) and Registration Regulations, 2021 commence · source

  3. Proceeds of Crime and Anti-Money Laundering Regulations, 2023 commence (gazetted 17 November 2023) · source

  4. Virtual Asset Service Providers Act, 2025 commences · source

  5. FATF keeps Kenya under increased monitoring and restates the action plan · source

The FATF listing itself dates from February 2024, when Kenya made its political commitment to the action plan (FATF). Watch each FATF plenary statement: an exit from the list would change how banking partners and foreign counterparties treat Kenyan fintechs, but not the domestic duties above.

Enforcement record and penalties

StackWeaver view, with the penalty schedules sourced

The ODPC is an active enforcer. It publishes its determinations by year, with archives for 2023 through 2026 (ODPC determinations). Reading a sample of them is the quickest way to learn what an investigation asks for: consent records, privacy notices, registration status and the speed of the response to the complainant.

The penalty schedules tell you what regulators and courts can do:

  • Data protection administrative fine: up to KES 5 million or, for an undertaking, 1% of the previous year's annual turnover, whichever is lower (DPA s. 63).
  • Ignoring an ODPC enforcement notice: a criminal offence carrying a fine of up to KES 5 million, up to two years in prison, or both (DPA s. 58(3)).
  • Failing reporting-institution duties under sections 44 to 47A is an offence (POCAMLA s. 11(1)), punished under section 16(2) (s. 16(2)).
  • For a company: a fine of up to KES 10 million or the value of the property involved, whichever is higher (s. 16(2)(b)).
  • For an individual: up to seven years in prison or a fine of up to KES 2.5 million, or both (s. 16(2)(a)).

StackWeaver view · The fines are not the biggest risk for a Kenyan fintech during the grey-list period. The bigger risk is commercial: a sponsor bank, card scheme or foreign partner that asks for evidence of your AML programme and finds it thin. Build the evidence pack for that conversation, and the examiner's visit becomes easier as well.

A practical 90-day plan

StackWeaver view

Start with the controls a supervisor or banking partner tests first: registration, the MLRO, the risk assessment and the suspicious transaction process.

Days 1–14: confirm status and register

Write the scoping memo: reporting institution or not, which supervisory body, controller or processor. Confirm FRC registration and ODPC registration, and put the ODPC certificate expiry in the compliance calendar. Appoint or confirm a management-level MLRO with the authority and independence the regulations require.

Days 15–45: refresh the risk assessment

Update the institutional risk assessment for your current products, channels and countries. Add a product-launch assessment step to your release process. Map which customers and counterparties touch higher-risk countries and how you apply enhanced due diligence to them.

Days 46–75: prove the clocks

Measure suspicion-to-filing time on your last 20 reports and fix the queue if any took longer than two days. Run one incident drill that exercises both the 72-hour breach notice and the suspicious transaction report. Check processor contracts for breach-notice terms.

Days 76–90: assemble the pack

Index evidence against each obligation in the table above. Ask someone outside the team to pick five obligations at random and find the proof unaided. Whatever they cannot find is your next quarter's work.

Common mistakes

StackWeaver view

  • Treating ODPC registration as optional because the company is small. Financial services sit in the Third Schedule, so the size exemption does not help.
  • Starting the two-day clock at the analyst's decision. The law counts from when the suspicion arose. Timestamp alerts and escalations so you can show when that was.
  • Keeping AML records for the data protection retention period. Records must be kept for at least seven years under POCAMLA, so reconcile the two retention schedules rather than deleting early.
  • Skipping the product-launch risk assessment. A new lending product, wallet feature or crypto rail needs its own assessment before launch, documented and approved.
  • Assuming a vendor's breach is the vendor's problem. The controller notifies the Data Commissioner. Contract for fast processor notice and test it.
  • Hosting abroad without paperwork. Transfers need proof of appropriate safeguards or another condition in the Act. Keep a transfer register that names every location.

Kenya AML and data protection evidence checklist

StackWeaver view, built on the sourced obligations above

Evidence checklist for Kenya AML and data protection readiness
Area Task Owner Evidence to keep
Scope Confirm whether you are a reporting institution under POCAMLA (financial institution or virtual asset service provider) and which supervisor applies to you. Legal / compliance Scoping memo citing your licence
AML governance Appoint a management-level Money Laundering Reporting Officer and register the institution with the Financial Reporting Centre. Board / CEO Appointment letter; FRC registration confirmation
AML risk Write and approve the institutional ML/TF/PF risk assessment, then diarise its review at least every two years. MLRO Approved risk assessment with board minute
AML risk Run a risk assessment before each new product, channel or technology goes live. Product / MLRO Signed product risk assessments
Customer due diligence Verify identity and beneficial ownership at onboarding; screen for PEPs and sanctions. Operations KYC file samples; screening logs
Customer due diligence Apply enhanced due diligence to higher-risk countries and prepare the annual return to the Centre. MLRO EDD files; filed annual return
Reporting Time every suspicious transaction report from suspicion to filing and test the two-day clock in a drill. MLRO STR log; drill results
Reporting Reconcile cash transaction reports to the ledger each month. Finance / MLRO Monthly reconciliation
Records Set retention for AML records to at least seven years and test that you can retrieve a sample quickly. Operations Retention schedule; retrieval test
Data protection Register with the ODPC (financial services cannot rely on the small-business exemption) and track the certificate expiry. DPO / Legal Registration certificate
Data protection Maintain a lawful-basis register and consent records, including express consent for marketing. DPO Register; consent logs
Data protection Complete DPIAs for high-risk processing such as credit scoring and biometric KYC, and submit them before processing. DPO DPIA reports; submission receipts
Breach Run a breach tabletop timed against the 72-hour notice to the Data Commissioner and processor 48-hour notices. Security / DPO Tabletop report; vendor contract clauses
Transfers Map every foreign hosting location and vendor, and keep proof of safeguards for each transfer. Security / Legal Transfer register; safeguard documents
Evidence pack Index evidence for each obligation so an examiner can trace any requirement to proof in minutes. Compliance Evidence index

Download the Kenya evidence checklist

An Excel workbook with every obligation, its legal source, an owner and the evidence to keep, plus the draft crosswalk.

We use your details to send the checklist and follow up about it. See our privacy policy.

Control crosswalk: Kenyan obligations to SOC 2 and ISO 27001

Draft mapping, pending named reviewer sign-off. SWC numbers refer to StackWeaver's common controls; SOC 2 references are Trust Services Criteria and ISO references are ISO/IEC 27001:2022 Annex A controls. Use it to reuse evidence, not as a statement that one framework satisfies another.

Draft crosswalk of Kenyan obligations to StackWeaver common controls, SOC 2 and ISO 27001
Kenyan obligation StackWeaver control SOC 2 ISO 27001:2022
Suspicious transaction reporting (POCAMLA s. 44) SWC-34 Suspicious and threshold transaction reporting CC7.2, CC7.3 A.5.24, A.5.25
Customer due diligence and beneficial ownership (s. 45) SWC-30 Customer due diligence and risk rating CC3.2 A.5.19
Enhanced due diligence, higher-risk countries (s. 45A) SWC-31 Enhanced due diligence and PEPs CC3.2 A.5.19
AML record keeping (s. 46) SWC-35 Record keeping CC5.3 A.5.33
Internal controls and MLRO (s. 47; reg. 12) SWC-02 Named accountable roles; SWC-03 Board and management oversight CC1.3, CC2.1 A.5.2, A.5.4
Risk assessment and new technologies (regs. 7–8) SWC-04 Risk assessment CC3.1, CC3.4 A.5.7, A.8.25
ODPC registration (DPA s. 18) SWC-29 Regulatory registration and filings CC2.3 A.5.31
Lawful basis and consent (ss. 30, 32, 37) SWC-23 Lawful basis and consent P2.1, P3.1 A.5.34
Impact assessments (s. 31) SWC-27 Data protection impact assessment CC3.2 A.5.34
Data subject rights and portability (ss. 26, 38) SWC-25 Data subject rights P5.1, P5.2 A.5.34
Retention (s. 39; reg. 19) SWC-26 Retention and disposal P4.2, P4.3 A.8.10
Breach notification (s. 43) SWC-22 Incident response and breach notification CC7.3, CC7.4 A.5.24, A.5.26
Cross-border transfers (ss. 48–50) SWC-28 Cross-border transfer safeguards CC9.2 A.5.14, A.5.23

A SOC 2 or ISO 27001 programme covers much of the security and incident evidence, but neither covers suspicious transaction reporting, due diligence or FRC registration. Those need AML-specific evidence. Teams also active in Nigeria can compare our guides to CBN AML/CFT and the NDPA, and our Egypt PDPL guide covers the North African data protection licensing model.

Frequently asked questions

Is Kenya still on the FATF grey list?

Yes, as of our last review. After its June 2026 plenary the FATF kept Kenya on its list of jurisdictions under increased monitoring and restated an action plan covering supervision, suspicious transaction reporting, beneficial ownership, targeted financial sanctions and non-profit oversight. Check the FATF's next plenary statement for changes.

Who counts as a reporting institution in Kenya?

The Proceeds of Crime and Anti-Money Laundering Act defines reporting institutions as financial institutions, designated non-financial businesses and professions, and virtual asset service providers. Payment, lending, wallet and crypto businesses should confirm their status with counsel and identify their supervisory body, such as the Central Bank of Kenya or the Capital Markets Authority.

How fast must we file a suspicious transaction report?

Section 44 of the Act requires a reporting institution to report a suspicious or unusual transaction or activity to the Financial Reporting Centre within two days after the suspicion arose. Attempted transactions must be reported too, and the institution must record its findings in writing and keep them for at least seven years.

Is there a cash reporting threshold?

Yes. The Fourth Schedule requires reporting institutions to file reports on all cash transactions exceeding US$15,000 or the equivalent in another currency, whether or not they appear suspicious. Fintechs that rarely touch cash should still document how they would detect and report a reportable cash transaction through agents or partners.

Do fintechs have to register with the ODPC?

In practice, yes. The Data Protection Act requires controllers and processors to register with the Data Commissioner. The registration regulations exempt very small businesses, but that exemption does not apply to processing for purposes in the Third Schedule, which lists the provision of financial services. Certificates last 24 months.

How quickly must a data breach be reported?

Section 43 requires the data controller to notify the Data Commissioner without delay and within 72 hours of becoming aware of a breach that creates a real risk of harm, and to tell affected people in writing within a reasonably practical period. Processors must alert the controller, where practicable within 48 hours.

Do we need a data protection impact assessment?

Where processing is likely to result in high risk to people's rights and freedoms, the Act requires an impact assessment before the processing starts, and section 31 says the report must be submitted 60 days before processing. Credit scoring, biometric onboarding and large-scale profiling are common fintech candidates for an assessment.

Can we host customer data outside Kenya?

Generally yes, with conditions. Section 48 requires proof to the Data Commissioner of appropriate safeguards or another listed condition, and the data protection principles bar transfers without adequate safeguards or consent. Separate localisation rules apply to listed strategic processing, such as systems designated as protected computer systems, so check whether any of yours is designated.

What are the penalties under Kenyan law?

Failing reporting-institution duties under the anti-money laundering law is an offence: a company faces a fine of up to KES 10 million or the value of the property involved, whichever is higher. The Data Commissioner can impose administrative fines of up to KES 5 million or 1% of an undertaking's turnover, whichever is lower.

Does the new crypto law affect fintechs?

It does for anyone providing virtual asset services. The Virtual Asset Service Providers Act, 2025 commenced on 4 November 2025, names the Capital Markets Authority and the Central Bank of Kenya as regulatory authorities, and virtual asset service providers are reporting institutions under the anti-money laundering law.

How StackWeaver helps

StackWeaver gives your compliance team and MLRO one workspace to request, collect and review the evidence each obligation above needs, with every file fingerprinted and every review decision recorded. Reviewed evidence can be exported as an Evidence Package that your counsel, an auditor or a partner firm can check offline. We are remote-first; we work with local counsel and advisory partners, and our Evidence Readiness Assessment is the starting point if you want help building the evidence pack.

Next steps

  1. 1. Download the Kenya evidence checklist (Excel, free)
  2. 2. Book a 20-minute call
  3. 3. Partner with us

Advisory, audit or legal firm in Kenya? Partner with us

Firms that advise Kenyan fintechs can run client evidence in StackWeaver workspaces and keep their own advice and audit work. Tell us about your practice and we will be in touch.

Partner with us

Sources and method

We cite Kenya Law's consolidated Proceeds of Crime and Anti-Money Laundering Act (Cap. 59A) and its 2023 Regulations; the Data Protection Act as printed by the Government Printer; the ODPC's copies of the General and Registration Regulations of 2021; and the Central Bank and Capital Markets Authority notice on the Virtual Asset Service Providers Act, 2025. FATF material comes from its statement on jurisdictions under increased monitoring of 19 June 2026; the FATF site blocked automated access when we checked, so we link to the Internet Archive's unaltered copy. Enforcement information comes from the ODPC's own site.

Every statement of law on this page is recorded in a public claims ledger with its source, section, retrieval date and the exact supporting words, and our build checks each source before publication. Facts are labelled “Sourced”; opinions and recommendations are labelled “StackWeaver view”, as our editorial policy explains. AI tools helped research and draft this guide; a named person at StackWeaver is accountable for it, and every legal statement was checked against the official text.

Spotted an error? Email [email protected]. More countries are in the Africa Fintech Regulatory Atlas.