Kenya

Section 9 requires public and private entities to put in place procedures appropriate to their size to prevent bribery and corruption; a director or senior officer who consents or connives in a failure to do so commits an offence (s.9(2)).

Reg. 3 requires every company to identify its beneficial owners and record their particulars, lodging Form BOF1 (register, reg. 3(5)) and Form BOF2 (changes, reg. 3(6)) with the Registrar; reg. 3(5C) gives a beneficial owner 14 days to notify the company of a change and reg. 4(2) gives 21 days to answer a company notice. The regulations set no number of days for lodging with the Registrar.

Section 14 requires officers and others in public or private entities to report known or suspected bribery to the Commission within twenty-four hours; failure is an offence under s.14(2).

Section 25 requires controllers and processors to follow the data protection principles, including lawful, fair and transparent processing, purpose limitation and data minimisation. Section 26 gives data subjects the rights to be informed, to access, to object, and to have false or misleading data corrected or deleted. Section 18(1) bars acting as a controller or processor without registration with the Commissioner.

Section 43(1)(a) requires the controller, where there is a real risk of harm, to notify the Data Commissioner within seventy-two hours of becoming aware of the breach, with reasons for any delay (s.43(2)); the data subject must also be told in writing (s.43(1)(b)). A processor must notify the controller without delay and, where practicable, within forty-eight hours (s.43(3)).

Section 21 provides that whistle-blowers, informants and witnesses shall not be intimidated or harassed for providing information; demoting, dismissing or otherwise harassing them carries a fine of up to KES 1 million, up to one year's imprisonment, or both. Section 65 of ACECA also bars proceedings against a person for assisting or informing the Commission.

Section 10(6) requires employers to keep written employment particulars for five years after termination; ss.20-21 require itemised pay statements and statements of statutory deductions.

Reg. 11 requires reporting institutions to adopt and implement internal control policies covering compliance management, staff screening, training and independent audit. Reg. 12(1)-(2) requires a management-level MLRO and reg. 12(3) requires notice of appointment or removal to the Centre and the supervisory body within fourteen days; section 47 of POCAMLA requires internal controls and reporting procedures.

Section 46(4) requires records to be kept for at least seven years from completion of the transaction or end of the account or relationship, unless the Centre requires longer in writing; s.44(5) applies seven years to findings on suspicious transactions and reg. 42 of the 2023 Regulations extends it to CDD records and correspondence.

Section 45(1) requires reasonable measures to establish the true identity of applicants and customers, s.45(2) applies due diligence to existing customers by risk and s.45(4)(b) requires beneficial owners to be identified and verified; s.45A requires enhanced due diligence for higher-risk countries. Regs. 14 and 25 of the 2023 Regulations set when CDD applies and require identity to be verified before or during establishing the relationship. The CBK's 2025 CDD guidance states there are no thresholds or exemptions.

Part IV(b) requires institutions to notify the CBK of any incident that could significantly affect service provision, reputation or financial condition, using the Annex II format, and Part IV(c) requires a quarterly incident report in the Annex III format.

Reg. 7(1)-(2) requires a documented, current risk assessment covering money laundering, terrorism financing and proliferation financing; reg. 7(3) requires board-approved policies based on it and reg. 8(2) requires an assessment before new products, practices or technologies.

Section 47A requires reporting institutions to register with the Centre and to notify changes in registered particulars within ninety days (s.47A(4)); failure to register is an offence (s.47A(5)).

Section 44(2) requires a report to the Financial Reporting Centre "within two days after the suspicion arose" and s.44(3) extends this to attempted transactions; reg. 38(1) of the 2023 Regulations repeats the two-day period. Section 44(6) separately requires reports of cash transactions at or above the Fourth Schedule threshold.

Section 12 bars anyone from conducting payment service business without authorisation, s.13 requires application to the CBK before starting and makes authorisations valid for twelve months, and ss.14-15 cover renewal and revocation. Reg. 25(3) of the 2014 Regulations requires all customer money to be held in a trust, not commingled, placed in licensed banks or government securities, and "not at any time be less than what is owed to customers"; reg. 11 sets core capital, for example KES 20,000,000 for e-money issuers.

Reg. 23(2) requires notification to the CBK before outsourcing is implemented, and reg. 23(3)-(5) restricts outsourcing of material functions. Reg. 16 requires 14 days' notice before enlisting new agents.

Section 8(2) bars carrying on virtual asset business in or from Kenya without a licence; s.8(1) limits eligibility to companies limited by shares, and s.13 provides that a licence expires on 31 December of the year of issue. Section 24(e) requires full AML/CFT/CPF preventive measures and s.44 requires transaction records to be kept for at least seven years.