AML/CFT Compliance for Payment Service Providers in Kenya

AML/CFT compliance for Payment Service Providers in Kenya has become one of the most critical areas of regulatory focus as the fintech sector continues to grow. Payment Service Providers – licensed by the Central Bank of Kenya under the National Payment System Act, 2011 – are classified as reporting institutions under the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA). This means that every PSP operating in Kenya carries the same core AML/CFT obligations as banks, insurance companies, and other financial institutions.

Kenya’s PSP landscape is diverse. It includes mobile money operators, payment processors and gateway providers, merchant payment aggregators, digital wallet providers, and interbank transfer platforms. Each of these entities processes significant transaction volumes through digital channels – creating both opportunity and responsibility when it comes to AML/CFT compliance for Payment Service Providers in Kenya.

Why AML/CFT Compliance for Payment Service Providers in Kenya Matters

PSPs occupy a unique position in Kenya’s financial infrastructure. They facilitate the movement of money at scale – often in real time, through digital channels, and increasingly without face-to-face interaction. This combination of speed, volume, and non-face-to-face engagement creates a risk profile that requires specific attention from compliance teams and regulators alike.

The CBK has been progressively strengthening its supervisory expectations for PSPs. The National Payment System Regulations, combined with POCAMLA obligations and CBK’s Cybersecurity Guidelines for PSPs, create a multi-layered compliance environment. PSPs that have invested in building their AML/CFT frameworks are well positioned to meet these expectations and to demonstrate compliance readiness during regulatory reviews and independent program audits. These factors make AML/CFT Compliance for Payment Service Providers in Kenya essential.

The Regulatory Framework for PSP AML/CFT Compliance

AML/CFT compliance for Payment Service Providers in Kenya is governed by multiple overlapping regulatory instruments. POCAMLA and the 2013 Regulations (as amended) establish the core AML/CFT obligations – CDD, risk assessment, transaction monitoring, suspicious transaction reporting, training, and record-keeping. The National Payment System Act, 2011 and its associated Regulations establish the licensing and operational requirements for PSPs, including governance, capital adequacy, and consumer protection standards.

CBK, as the supervisory authority for PSPs, conducts periodic compliance reviews and inspections. The Financial Reporting Centre (FRC) oversees AML/CFT compliance across all reporting institutions, including PSPs. PSPs must therefore satisfy both CBK’s sector-specific requirements and the FRC’s AML/CFT expectations.

Customer Due Diligence for Digital Payment Channels

CDD for PSPs presents unique challenges because most customer onboarding occurs through digital channels. Mobile money registration, digital wallet creation, and merchant onboarding are typically conducted without face-to-face interaction – which POCAMLA and FATF standards classify as higher-risk. PSPs must implement robust digital identity verification that meets the same standard of reliability as traditional document-based CDD.

For mobile money operators, SIM registration data provides the foundation for CDD, supplemented by national ID verification. For payment aggregators and processors, merchant CDD includes verifying the business registration, identifying beneficial owners, and understanding the nature of the merchant’s business. For all PSPs, ongoing CDD is essential – reviewing and updating customer information periodically and applying enhanced due diligence to higher-risk customers such as PEPs, high-value merchants, and customers with cross-border transaction patterns.

Transaction Monitoring at Scale

Transaction monitoring is where AML/CFT Compliance for Payment Service Providers in Kenya faces its most significant operational challenge. PSPs process millions of transactions daily, often in real time. The monitoring framework must be designed to detect suspicious patterns within this volume without creating an unmanageable alert load.

Effective PSP transaction monitoring typically combines rule-based scenarios (cash-in/cash-out thresholds, structuring detection, velocity rules, cross-border transfer monitoring) with risk-based analytics that incorporate the customer’s profile, expected transaction patterns, and behavioural indicators. Monitoring rules should be calibrated to the PSP’s specific product mix – mobile money rules differ from payment gateway rules, which differ from digital wallet rules.

The AML/CFT program audit evaluates whether the PSP’s monitoring system is adequately calibrated, whether alerts are investigated within defined timelines, and whether the monitoring framework is regularly reviewed and updated to reflect evolving risks and typologies.

Agent Network Controls

Many PSPs operate through extensive agent networks. Agent networks create additional AML/CFT risk because transactions may occur at remote locations with limited oversight, agents may process cash transactions that bypass direct PSP monitoring, and agents may themselves be vulnerable to misuse by money launderers seeking to structure transactions across multiple agent points.

PSPs should ensure that their AML/CFT framework addresses agent due diligence and onboarding, agent training on AML/CFT awareness and red flag identification, monitoring of agent transaction patterns for anomalies, controls to prevent and detect structuring across agent locations, and procedures for suspending or terminating agents who fail to meet compliance requirements.

Suspicious Transaction Reporting for PSPs

PSPs are required to file Suspicious Transaction Reports (STRs) with the FRC whenever they have reasonable grounds to suspect that a transaction is related to money laundering, terrorism financing, or proliferation financing. Given the volume of transactions PSPs process, the internal escalation process – from automated alert through analyst investigation to MLRO determination – must be efficient, well-documented, and supported by clear decision-making criteria.

PSPs must also file cash transaction reports (CTRs) for qualifying transactions exceeding USD 15,000 or its equivalent. For mobile money operators handling significant cash-in and cash-out volumes, this reporting obligation requires robust system-level controls to capture all qualifying transactions automatically.

Governance and the MLRO Function

Every PSP must appoint a Money Laundering Reporting Officer with the competence, authority, and resources to oversee the AML/CFT programme. In fast-growing fintech companies, the compliance function can be under-resourced relative to the pace of product development and customer acquisition. Boards and management teams of PSPs should ensure that the MLRO has sufficient staff, direct access to the board, and the authority to influence operational decisions where compliance risks are identified.

The board carries ultimate responsibility for AML/CFT compliance for Payment Service Providers in Kenya. Board members should receive AML/CFT training that covers the PSP’s specific risk profile, regulatory expectations from CBK and the FRC, and their governance obligations. FNJ & Associates provides tailored board-level AML/CFT training for PSPs and fintech companies.

Preparing for the AML/CFT Program Audit

The independent AML/CFT program audit evaluates the PSP’s compliance framework across all seven audit objectives – CDD, risk assessment, governance, monitoring, STR reporting, training, and record-keeping. PSPs that have invested in building structured compliance programmes will find that the audit validates their approach and identifies specific areas for further strengthening.

For PSPs undertaking the program audit for the first time, FNJ & Associates can conduct a readiness assessment to identify areas for enhancement before the formal audit. Trigarc Compliance, implemented by FNJ, enables PSPs to automate compliance obligation tracking, policy attestation, training records, and board-ready reporting across all AML/CFT programme components.

Frequently Asked Questions

Are all Payment Service Providers required to comply with AML/CFT regulations in Kenya?

Yes. All PSPs licensed by the CBK under the National Payment System Act are classified as reporting institutions under POCAMLA and must comply with the full range of AML/CFT obligations, including CDD, transaction monitoring, suspicious transaction reporting, training, and record-keeping.

How does CDD work for mobile money customers?

Mobile money CDD typically relies on SIM registration data and national ID verification at onboarding, supplemented by ongoing monitoring of transaction activity. PSPs must ensure that their digital identity verification meets the same standard of reliability as traditional CDD, and must apply enhanced due diligence for higher-risk customers. Effective CDD is a key component in ensuring AML/CFT compliance for Payment Service Providers in Kenya

What transaction monitoring rules should PSPs implement?

PSPs should implement monitoring rules tailored to their specific products and risk profile. Common rules include cash-in/cash-out thresholds, structuring detection, velocity monitoring, cross-border transfer surveillance, and dormant account activity alerts. Rules should be regularly calibrated to manage false positive rates and reflect evolving typologies.

Who supervises PSPs for AML/CFT compliance in Kenya?

The CBK is the primary supervisory authority for PSPs under the National Payment System Act. The Financial Reporting Centre oversees AML/CFT compliance for all reporting institutions, including PSPs. Both may conduct inspections and request information.

Can FNJ & Associates conduct AML/CFT program audits for PSPs?

Yes. FNJ & Associates conducts independent AML/CFT program audits for Payment Service Providers across Kenya, structured around the seven audit objectives and tailored to the fintech sector’s unique risk profile. Contact us at [email protected] to discuss your requirements.