Developing an AML/CFT Framework in Kenya: Policies and Implementation Guide

Every reporting institution needs an AML/CFT framework in Kenya. This is not merely a regulatory expectation; it is the architectural foundation upon which every other element of the compliance programme is built. The ML/TF risk assessment, customer due diligence procedures, transaction monitoring, suspicious transaction reporting, training, and record-keeping all derive their structure and direction from the overarching framework.

Organisations that invest in designing a coherent, well-documented framework find that the rest of the compliance programme falls naturally into place. The framework provides clarity on roles and responsibilities, ensures that policies are consistent with each other and with the organisation’s risk appetite, and gives the board a structured basis for oversight.

This guide sets out a practical approach to developing an AML/CFT framework in Kenya, along with a full policy suite for reporting institutions, applicable across banking, fintech, SACCOs, insurance, DNFBPs, and the NGO sector.

What an AML/CFT Framework Should Cover

An effective AML/CFT framework in Kenya is a comprehensive structure that connects the organisation’s governance arrangements, risk assessment, policies, procedures, monitoring, reporting, and training into one integrated system. It should articulate the organisation’s commitment to combating money laundering, terrorism financing, and proliferation financing, and provide a clear roadmap for how that commitment is operationalised.

The framework typically includes the following components: the governance structure and accountability model, the risk appetite statement for AML/CFT, the policy hierarchy, the risk assessment methodology, the compliance monitoring and testing plan, the reporting framework (both internal and external), and the training and awareness strategy. Each component of the AML/CFT framework in Kenya should be documented, board-approved, and subject to periodic review.

Governance Structure and the MLRO

Within an AML/CFT framework in Kenya, the governance structure defines who is responsible for what. Under POCAMLA, every reporting institution must appoint a Money Laundering Reporting Officer (MLRO) at management level with the relevant competence, authority, and independence to oversee the AML/CFT program. The MLRO is the central figure in the compliance governance model, responsible for receiving and evaluating internal suspicious activity reports, making decisions on STR filings to the FRC, overseeing the CDD framework, and reporting to the board on the status of the AML/CFT program.

Beyond the MLRO, the governance structure should clearly define the board’s oversight role (typically exercised through the board risk or audit committee), the reporting line from the MLRO to the board, the role of senior management in implementing the compliance program, and the responsibilities of the first line (business units) in executing CDD and monitoring procedures. This three lines model – business operations, compliance oversight, and independent audit – provides the checks and balances that regulators expect within any AML/CFT framework in Kenya.

The Policy Hierarchy

A well-structured AML/CFT framework in Kenya follows a clear policy hierarchy. At the top sits the board-approved AML/CFT Policy, which sets out the organisation’s commitment, risk appetite, governance arrangements, and high-level obligations. This policy is the document that the board formally adopts and that regulators review first.

Beneath the policy sit the supporting procedures and operational guidelines. These translate the policy commitments into practical, step-by-step instructions that staff can follow. For example, the CDD procedure would set out exactly how to verify a customer’s identity, what documents are acceptable, when to apply EDD, and how to handle cases where CDD cannot be completed. The STR procedure would define the internal escalation process, the decision-making criteria, the filing process, and the tipping-off controls.

Aligning the Framework to POCAMLA

Any AML/CFT framework in Kenya must be explicitly mapped to the requirements of POCAMLA and the Proceeds of Crime and Anti-Money Laundering Regulations (as amended). This regulatory mapping exercise ensures that every obligation under the law has a corresponding policy, procedure, or control within the organisation’s framework.

For institutions regulated by sector-specific supervisory bodies, the AML/CFT framework in Kenya should also incorporate the AML/CFT guidelines issued by CBK, IRA, CMA, or SASRA as applicable. Where the institution operates across borders, the framework should address the requirement to apply AML/CFT measures in foreign branches and subsidiaries to the extent permitted by local law, and to notify the FRC where the host country’s AML/CFT requirements fall below Kenya’s standards.

Risk Appetite and the Risk-Based Approach

The AML/CFT framework in Kenya should articulate the organisation’s risk appetite for ML/TF/PF risk. This is a statement, approved by the board, that defines the level of residual ML/TF risk the organisation is willing to accept after controls are applied. The risk appetite informs decisions on which customer categories the institution will serve, which products it will offer, which jurisdictions it will operate in, and the intensity of controls it will apply.

The risk-based approach is the golden thread that runs through every component of the AML/CFT framework in Kenya. POCAMLA and the FATF standards both require that reporting institutions apply a risk-based approach, directing the most resources and the most intensive controls toward the areas of highest risk. The ML/TF risk assessment provides the evidence base; the framework translates that evidence into proportionate policies and controls.

Compliance Monitoring and Testing

An AML/CFT framework in Kenya without monitoring is a framework on paper. The compliance monitoring plan should define how the organisation will test the effectiveness of its AML/CFT controls on an ongoing basis. This includes first-line monitoring (business units checking their own CDD and transaction monitoring compliance), second-line testing (the compliance function conducting thematic reviews, sample testing, and quality assurance), and third-line assurance (internal and external audit providing independent assessment).

The monitoring plan should specify what will be tested, how often, by whom, and how findings will be reported and remediated. Trigarc Compliance, implemented by FNJ, enables organisations to automate this monitoring cycle; tracking compliance obligations, managing self-assessments, generating corrective action plans, and providing real-time dashboards for board and management reporting.

Implementation Roadmap

For organisations developing an AML/CFT framework in Kenya for the first time, or significantly enhancing an existing one, the following phased approach has proven effective:

• Foundation: Conduct the ML/TF risk assessment, define the governance structure, appoint the MLRO, and draft the AML/CFT policy.
• Policies and Procedures: Develop the CDD, EDD, transaction monitoring, STR, training, and record-keeping procedures. Map all procedures to POCAMLA requirements.
• Implementation: Roll out the policies and procedures, deliver staff training, configure monitoring systems, and establish reporting lines.
• Testing and Refinement: Conduct initial compliance testing, identify areas for enhancement, update procedures based on findings, and prepare for the independent AML/CFT program audit.

Frequently Asked Questions

What is the difference between an AML/CFT framework and an AML/CFT policy?

The framework is the overarching structure that connects governance, risk assessment, policies, procedures, monitoring, reporting, and training into one integrated system. The policy is one component within the framework; specifically, the board-approved document that sets out the organisation’s commitment, risk appetite, and high-level obligations.

Who approves the AML/CFT framework?

Within an AML/CFT framework in Kenya, the board of directors approves the AML/CFT policy and the governance structure. Supporting procedures and operational guidelines are typically approved by the MLRO or senior management, within the authority delegated by the board.

How often should the AML/CFT framework be reviewed?

The AML/CFT framework in Kenya should be reviewed at least annually, and updated whenever there are material changes to the organisation’s risk profile, product offerings, regulatory requirements, or business environment. The ML/TF risk assessment should be updated at least every two years under POCAMLA or other frequency stipulated by sector-specific guidelines.

Does every organisation need a separate AML/CFT policy?

Yes. Every reporting institution must have its own AML/CFT policy tailored to its specific risk profile, products, services, and customer base. Group entities may adopt a group policy framework, but each entity should have policies that reflect its own regulatory environment and risk assessment.

Can FNJ & Associates help develop our AML/CFT framework?

Yes. FNJ & Associates provides end-to-end AML/CFT framework development services, including risk assessment, governance design, policy and procedure drafting, regulatory mapping, training programme design, and implementation support. Contact us at [email protected] to discuss your requirements.