AML/CFT Program Audit in Kenya: A Cross-Sector Guide

Across Kenya and East Africa, the regulatory expectation is that a reporting institution should have its AML/CFT program independently audited. This is not limited to banks: the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) and the accompanying Regulations (as amended) apply to a broad range of entities, from commercial banks and insurance companies to SACCOs, fintechs, real estate agents, dealers in precious metals, law firms, and non-governmental organisations.

Organisations that have already invested in building their AML/CFT compliance programs recognise that the independent audit is a valuable opportunity: it validates what is working well, identifies areas for further strengthening, and provides the board and regulators with assurance that the program is fit for purpose.

This guide walks through the seven core objectives that an AML/CFT program audit in Kenya should cover, with practical considerations for each sector.

Why the AML/CFT Program Audit in Kenya Matters

The AML/CFT program audit in Kenya serves multiple purposes. For the board and senior management, it provides independent assurance that the organisation’s compliance framework is operating as designed. For regulators, whether the Central Bank of Kenya (CBK), the Insurance Regulatory Authority (IRA), the Capital Markets Authority (CMA), SASRA, or the Financial Reporting Centre (FRC), it demonstrates that the institution is meeting its legal obligations under POCAMLA.

For the compliance function itself, the audit is an opportunity to benchmark the programme against regulatory expectations and leading practice, identify areas where processes can be enhanced, and strengthen the organisation’s overall resilience against money laundering, terrorism financing, and proliferation financing risks.

Objectives of AML/CFT Program Audit in Kenya

An effective AML/CFT program audit in Kenya is structured around seven core objectives. Each objective maps to a specific component of the compliance programme, and together they provide a complete picture of the organisation’s AML/CFT readiness.

Objective 1: Customer Due Diligence Measures

The AML/CFT Program audit in Kenya evaluates the existence, adequacy, and effectiveness of the institution’s customer due diligence (CDD) measures. This includes the processes for identifying and verifying customers at onboarding, applying enhanced due diligence (EDD) for higher-risk customers such as politically exposed persons (PEPs), correspondent banking relationships, and customers from high-risk jurisdictions, as well as the mechanisms for ongoing CDD throughout the customer relationship.

For banks and fintechs, this objective covers digital onboarding verification, electronic KYC processes, and the adequacy of identity verification technologies. For SACCOs, it addresses the unique dynamics of member-based institutions where customers are also owners. For insurance companies, it extends to policyholder and beneficiary due diligence. For DNFBPs such as law firms and real estate agents, the audit examines whether CDD processes are proportionate to the nature of the professional relationship.

Objective 2: ML/TF/PF Risk Assessment Frameworks

The AML/CFT Program audit in Kenya evaluates the appropriateness of the existing money laundering, terrorism financing, and proliferation financing (ML/TF/PF) risk assessment frameworks and reports. Under POCAMLA, every reporting institution is required to conduct a risk assessment that identifies, assesses, and documents the risks it faces, and to update this assessment at least every two years or whenever material changes occur.

The auditor examines whether the risk assessment methodology is sound, whether it covers all relevant risk categories (customers, products, services, delivery channels, and geographic exposure), whether the findings are clearly documented, and whether the risk assessment informs the design of the institution’s AML/CFT controls. Organisations that have already completed robust risk assessments will find that this objective validates their methodology and identifies opportunities for further refinement.

Objective 3: Internal Controls, Governance Structure, Policies, and Procedures

This objective of the AML/CFT Program Audit in Kenya evaluates the adequacy of the institution’s internal controls governance structure, policies, and procedures for AML/CFT compliance. The audit examines the board’s oversight role, the appointment and mandate of the Money Laundering Reporting Officer (MLRO), the independence of the compliance function, the three lines model as applied to AML/CFT, and the quality and comprehensiveness of the institution’s AML/CFT policy suite.

The auditor reviews whether policies are board-approved, regularly updated, communicated to all relevant staff, and supported by detailed operational procedures. For group structures, the audit also considers whether group-wide AML/CFT policies are appropriately cascaded to subsidiaries and branches, including those in other jurisdictions.

Objective 4: Monitoring Processes and Systems

The audit reviews the institution’s monitoring processes and the adequacy of systems used for monitoring. This includes the rules, scenarios, and thresholds used to detect suspicious patterns, the alert management process, the handling and escalation of alerts, and the frequency and method of monitoring.

For institutions with automated transaction monitoring systems, the audit evaluates the calibration of monitoring rules, the false positive rate, the timeliness of alert investigation, and the documentation of investigation outcomes. For smaller institutions relying on manual monitoring, common among SACCOs, some insurance companies, and DNFBPs, the audit assesses whether the manual processes are appropriately designed, consistently applied, and adequately documented.

Objective 5: Suspicious Transaction Reporting

The audit analyses the institution’s reporting process for suspicious transactions and activity. Under POCAMLA, reporting institutions are required to file Suspicious Transaction Reports (STRs) with the Financial Reporting Centre (FRC) whenever they have reasonable grounds to suspect that a transaction or activity is related to money laundering, terrorism financing, or proliferation financing.

The auditor examines the end-to-end STR process: how potential suspicious activity is identified, how it is escalated internally, how the decision to file is made, the quality and timeliness of STR filings, whether the institution complies with the tipping-off prohibition, and whether cash transactions exceeding the prescribed threshold are reported to the FRC. The audit also assesses whether the institution maintains adequate records of all STRs filed and any related internal investigations.

Objective 6: AML/CFT/CPF Training Programme

The audit assesses the organisation’s AML/CFT/CPF training programme. POCAMLA requires reporting institutions to establish ongoing training programmes for their employees to ensure awareness of money laundering, terrorism financing, and proliferation financing risks, as well as the institution’s policies, procedures, and legal obligations.

The auditor evaluates whether the training programme is structured, role-based, and delivered at appropriate frequencies. Board and senior management training should cover governance responsibilities and strategic risk, while operational staff training should address practical red flag identification, CDD procedures, escalation protocols, and STR processes. The audit also reviews whether training records are maintained, whether training effectiveness is measured, and whether new employees receive induction training on AML/CFT obligations.

Objective 7: Record-Keeping and Retention

The audit reviews the organisation’s record-keeping and retention processes. POCAMLA requires reporting institutions to maintain records of all transactions, both domestic and international, for a minimum period of seven years from the date the transaction was completed or the account or business relationship was terminated.

The auditor assesses whether the institution maintains all required records, including CDD documentation, transaction records, STR filings and related correspondence, training records, and internal investigation files. The audit also evaluates the organisation’s ability to retrieve records promptly in response to requests from the FRC, supervisory bodies, or law enforcement agencies.

Sector-Specific Considerations

How FNJ & Associates Can Help

FNJ & Associates delivers independent AML/CFT program audits across all reporting institution categories in Kenya and East Africa. Our approach is structured around the seven audit objectives, tailored to the specific regulatory context and risk profile of each sector. We provide clear, actionable findings and practical recommendations that strengthen your organisation’s AML/CFT framework.

For organisations looking to automate and streamline their ongoing AML/CFT compliance management, Trigarc Compliance, implemented by FNJ, provides regulatory obligation tracking, policy attestation workflows, training record management, and board-ready compliance reporting, all in one integrated platform.

Frequently Asked Questions

Who is required to undergo an AML/CFT program audit in Kenya?

Reporting institutions designated under POCAMLA are required to have their AML/CFT programs independently audited. This includes banks, mortgage finance companies, insurance companies, SACCOs, capital markets intermediaries, fintechs, and designated non-financial businesses and professions (DNFBPs) such as law firms, real estate agents, accountants, and dealers in precious metals and stones.

How often should the AML/CFT program audit be conducted?

Best practice is to conduct the AML/CFT program audit annually. Some sector-specific regulators, such as CBK and IRA, may prescribe specific frequencies. The audit should also be conducted whenever there are material changes to the institution’s risk profile, products, or regulatory environment.

What is the difference between the AML/CFT program audit and the ML/TF risk assessment?

The ML/TF risk assessment identifies and evaluates the money laundering and terrorism financing risks facing the institution. The AML/CFT program audit evaluates whether the institution’s compliance program, including the risk assessment itself, is adequately designed and operating effectively. The risk assessment is one of the seven components that the program audit reviews.

Can the AML/CFT program audit be conducted by the internal audit function?

While internal audit can conduct reviews of AML/CFT controls as part of its regular audit plan, the independent AML/CFT program audit is typically conducted by an external firm with specialised AML/CFT expertise to ensure objectivity and independence. FNJ & Associates provides this service across all sectors.

What happens if the audit identifies significant findings?

Audit findings are reported to the board and senior management with recommended corrective actions. FNJ & Associates helps organisations develop and implement remediation plans, and Trigarc Audit, which we implement, can track the follow-up and closure of all audit findings.