Banks and microfinance banks
Board-approved risk management and AML/CFT programmes, an independent internal audit function, ICT and cybersecurity controls, and core capital that meets the phased minimums.
What boards expect from complianceFinancial institutions
Risk and compliance for financial institutions in Kenya
FNJ & Associates is an ICPAK-registered CPA firm in Nairobi that helps banks, SACCOs, microfinance institutions, digital lenders, payment and remittance providers, forex bureaus, virtual asset service providers, capital markets firms, insurers and pension schemes get licensed and stay compliant. We prepare licence applications, run independent AML/CFT audits and outsourced internal audit and compliance functions, build risk frameworks, and implement Trigarc to track obligations.
ICPAK-registered CPA firmCPA, CIA, CISA, CFE, CAMS, CEH, CIPP/ETrigarc, implemented by FNJNairobi, serving East Africa
Who we work with
What each regulator expects, and how we help
Kenya's financial institutions answer to five regulators and the Financial Reporting Centre, and every licence type has its own rulebook. We organise our work around yours.
Banking and credit
SACCOs
Deposit-taking and specified non-withdrawable deposit-taking SACCOs need sound governance and internal controls, AML/CFT compliance now supervised by SASRA, and an external auditor from SASRA's approved list.
AML compliance for SACCOsMicrofinance institutions, lenders and digital credit providers
The Non-Deposit Taking Credit Providers Regulations, 2026 bring digital lenders, asset financiers and other credit businesses under CBK licensing or registration, with fit and proper and AML/CFT requirements.
AML/CFT for digital credit providersPayments and foreign exchange
Payment service providers and e-money issuers
Authorisation under the National Payment System Act and Regulations, safeguarding of customer funds, transaction monitoring and suspicious transaction reporting. A draft NPS Bill 2026 would raise capital requirements.
AML/CFT for payment service providersMoney remittance providers
Licensing under the CBK (Money Remittance) Regulations, customer due diligence on senders and recipients, sanctions screening and reporting of suspicious and large cash transactions.
AML/CFT for remittance providersForex bureaus
Licensing and conduct under CBK's Forex Bureau Guidelines, know-your-customer records for every transaction, cash transaction reporting and regular returns to CBK.
Transaction monitoring guideCapital markets and virtual assets
Fund managers, stockbrokers and investment advisers
CMA licensing, a risk-based AML/CFT programme, independent review of that programme, beneficial ownership and politically exposed person checks, and compliance and risk functions sized to the firm.
Building an AML/CFT frameworkVirtual asset service providers
Licensing under the VASP Act 2025 and the VASP Regulations 2026, minimum capital, governance, cybersecurity and a full AML/CFT programme. CMA licenses exchanges and brokers; CBK licenses wallet, payment and stablecoin activities.
ML/TF risk assessmentInsurance and pensions
Insurers and intermediaries
AML/CFT programmes under the Insurance (AML/CFT) Guidelines with independent reviews, risk-based capital, risk management and internal audit functions, and fraud controls across claims and distribution.
AML/CFT programme auditsRetirement benefits schemes
Trustee governance, internal controls and risk management under RBA's risk-based supervision. RBA is also the AML/CFT supervisor for the retirement benefits sector since the 2025 amendments.
Trustee and board trainingLicensing
Licence application support
We prepare the documents regulators review, answer their follow-up questions with you, and set up the compliance calendar you will run once licensed.
Licences we support: CBK non-deposit-taking credit provider licence or registration, payment service provider and e-money authorisation, money remittance and forex bureau licences, VASP licences from CBK or CMA, CMA licences for fund managers, stockbrokers and investment advisers, and insurance intermediary licences.
Discuss your licence application- 1Readiness review against the licence requirements and minimum capital
- 2Business plan and financial projections
- 3Fit and proper files for shareholders, directors and senior officers
- 4AML/CFT policy, ML/TF risk assessment and customer due diligence procedures
- 5Governance, risk management and internal control frameworks
- 6ICT, cybersecurity and business continuity policies
- 7Data protection registration and privacy notices
- 8Responses to regulator queries until approval
- 9Post-licence compliance calendar, FRC goAML registration and staff training
Regulatory tracker
What is changing for Kenyan financial institutions
Status as of 16 October 2026. Drafts are shown as proposals, not law. Each row links to its source, and we update the table when the rules change.
| Change | Who it affects | Status | What to do |
|---|---|---|---|
| Non-Deposit Taking Credit Providers Regulations, 2026 (Legal Notice No. 191) | Digital lenders, microfinance institutions, asset financiers and other credit businesses | IN FORCE Gazetted 29 Sep 2026; replaces the Digital Credit Providers Regulations, 2022. Unlicensed lenders have six months to apply. Source | Confirm whether you need a licence or registration; prepare the application, fit and proper files and AML/CFT programme. |
| CBK draft Prudential Guidelines, Risk Management Guidelines, Guidance Notes and framework for domestic systemically important banks | Banks, microfinance banks | DRAFT Released 10 Sep 2026. Comments due 7 Nov 2026. The 2013 guidelines apply until replaced. Source | Run a gap assessment against the drafts and budget for changes in 2027. |
| Draft National Payment System Policy and Bill, 2026 | Payment service providers, e-money issuers, remittance providers | DRAFT Released 21 Sep 2026; comments closed 9 Oct 2026. Proposes KSh 250m minimum capital for e-money issuers and KSh 30m for remittance providers. Source | Model the capital impact. The National Payment System Act 2011 applies until a new law is passed. |
| Virtual Asset Service Providers Act, 2025 and VASP Regulations, 2026 (Legal Notice No. 134) | Exchanges, brokers, wallet providers, stablecoin issuers | IN FORCE Act in force 4 Nov 2025; regulations dated 22 Jul 2026. Minimum capital KSh 100m for exchanges and KSh 300m for stablecoin issuers. Source | Existing operators: complete licensing within the Act's one-year transition. |
| Central Bank of Kenya (Amendment) Act, 2026 | Banks and CBK-regulated institutions | IN FORCE Since 24 Jul 2026. Adds a formal emergency liquidity assistance regime and a financial stability objective. Source | Update the obligations register, liquidity contingency plans and board reporting. |
| Minimum core capital for banks | Banks | IN FORCE At least KSh 3bn now, rising in phases to KSh 10bn. Treasury has announced more time for the final step. Source | Keep the capital plan and capital adequacy assessment current. |
| AML and Combating of Terrorism Financing Laws (Amendment) Act, 2025 | SACCOs, pension schemes and other reporting institutions | IN FORCE Since June 2025. Makes SASRA, RBA and other sector regulators AML/CFT supervisors. Source | Expect AML/CFT inspections from your sector regulator, not only the FRC. |
| SASRA list of approved external auditors, 2026 | Regulated SACCOs | PUBLISHED 13 Mar 2026. Accounts audited by firms not on the list are not considered for regulatory approval. Source | Confirm your external auditor is on the current list before appointment at the AGM. |
| IRA independent reviews of insurers' AML/CFT programmes | Insurers | IN FORCE Required since September 2025. Source | Schedule an independent AML/CFT review and track findings to closure. |
| Retirement Benefits (Post-Retirement Medical Funds) Regulations, 2026 (Legal Notice No. 146) | Pension schemes and post-retirement medical funds | IN FORCE Gazetted 7 Aug 2026. Sets trustee structures, member-elected trustees and term limits. Source | Review trustee board composition and fund governance documents. |
| FATF increased monitoring (grey list) | All reporting institutions | ONGOING Listed since February 2024; still listed after the June 2026 plenary. Source | Expect closer scrutiny from regulators and correspondent banks. |
| IIA Cybersecurity Topical Requirement | Internal audit functions | IN FORCE Effective 5 Feb 2026. Source | Cover cybersecurity governance, risk and controls in the internal audit plan. |
Services
Services for financial institutions
Licence applications
Readiness reviews, application packs and regulator queries for CBK, CMA and IRA licences.
Request a proposalIndependent AML/CFT audits
Independent testing of your AML/CFT programme against POCAMLA and your regulator's guidance, with a graded remediation plan.
How we audit AML/CFT programmesAML/CFT programme design
Risk assessments, policies, customer due diligence, transaction monitoring, goAML reporting and the annual compliance report.
AML/CFT framework guideInternal audit
Outsourced and co-sourced internal audit to the Global Internal Audit Standards, with audit committee reporting and follow-up.
Internal audit servicesRisk management and RCSA
Enterprise risk management frameworks, risk appetite statements and risk and control self assessments.
Risk management servicesCompliance function
Set up, review or outsource the compliance function, with an obligations register and board reporting.
Compliance servicesIT and cybersecurity assurance
ICT audits, cybersecurity assessments, vulnerability assessment and penetration testing, and third-party reviews.
Request a proposalData protection
ODPC registration, data protection impact assessments, privacy audits and outsourced data protection officer support.
Request a proposalForensic investigations
Fraud investigations, asset tracing and digital forensics when something goes wrong.
Forensic servicesTraining
AML/CFT training for staff and directors, trustee training, and board and audit committee training.
Corporate trainingIFRS 9 expected credit loss
Expected credit loss models and reviews for SACCOs, microfinance institutions and lenders.
Request a proposalChecklist
What does an independent AML/CFT audit cover?
An independent AML/CFT audit tests whether your programme works in practice, not just on paper. We test samples of real customers and transactions and grade every finding by risk, so your board knows what to fix first.
Request an AML/CFT audit- 1Your ML/TF risk assessment, and whether it drives your controls
- 2Board and senior management oversight, and the money laundering reporting officer's role
- 3Customer due diligence, KYC and beneficial ownership
- 4Enhanced due diligence for higher-risk customers, including politically exposed persons
- 5Sanctions and targeted financial sanctions screening
- 6Transaction monitoring rules and how alerts are handled
- 7Suspicious and cash transaction reports filed through goAML
- 8Record keeping and data retention
- 9Staff training and how the programme is tested
Trigarc, implemented by FNJ
Track obligations, risks and audit issues in one place
We implement Trigarc for banks, SACCOs, insurers, microfinance institutions, lenders and fintechs. These are the three set-ups financial institutions ask for most.
Trigarc Compliance
AML obligation tracking
Every POCAMLA and regulator obligation with an owner, a due date and evidence, ready for board and regulator reporting.
Trigarc Risk
Risk register and appetite monitoring
Risks, controls and key risk indicators measured against the appetite your board approved.
Trigarc Audit
Audit issue tracking
Internal, external and regulator findings tracked to closure, with reminders to owners.
Modules: Trigarc Audit, Trigarc Risk, Trigarc Compliance, Trigarc Governance and Trigarc Ethics.
Book a Trigarc demo with FNJOur work
Engagements we deliver for financial institutions
SACCOs, insurers, payment providers
AML/CFT programme audits
Independent testing ahead of regulator inspections, with graded findings for the board.
Lenders, fintechs, remittance providers
Licence applications
Application packs, policies and regulator queries through to approval.
Banks, microfinance, SACCOs
Outsourced internal audit and RCSA
Risk-based audit plans, risk and control self assessments and audit committee reporting.
All sectors
Fraud investigations
Investigations into internal fraud, loan fraud and digital channel fraud, with evidence that stands up.
We do not publish client names. References from financial institutions are available on request, including for tenders and procurement evaluations.
Guides
Guides for compliance and risk teams
AML/CFT by sector
AML compliance for SACCOsAML/CFT for digital credit providersAML/CFT for payment service providersAML/CFT for money remittance providersAML/CFT programme audit: a cross-sector guideFAQ
Questions financial institutions ask us
Do digital lenders need a CBK licence?
Yes, if they fall within the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026, gazetted on 29 September 2026 as Legal Notice No. 191. The regulations cover digital lenders and other credit businesses that do not take deposits, require a licence or registration depending on size, and give lenders not yet licensed six months to apply. CBK had licensed 281 digital credit providers by 30 September 2026.
Do virtual asset service providers need a licence in Kenya?
Yes. The Virtual Asset Service Providers Act, 2025 has been in force since 4 November 2025, and the VASP Regulations, 2026 set minimum capital of KSh 100 million for exchanges and KSh 300 million for stablecoin issuers. CMA licenses exchanges and brokers, CBK licenses wallet, payment and stablecoin activities, and existing operators had one year from commencement to comply.
What must reporting institutions file with the Financial Reporting Centre?
Through goAML: suspicious transaction reports within two days of the suspicion arising, reports of cash transactions of USD 15,000 or more (or the equivalent), and an annual compliance report by 31 January. A change of money laundering reporting officer must be notified within 14 days.
What does an independent AML/CFT audit cover?
It tests whether your AML/CFT programme works in practice: the risk assessment, governance, customer due diligence, sanctions screening, transaction monitoring, goAML reporting, record keeping and training. The result is a graded findings report and a remediation plan your board can track.
Who can audit a regulated SACCO in Kenya?
Only an auditor with a valid ICPAK practising certificate who is on SASRA's list of approved external auditors for that year, is approved by members at the annual general meeting and meets the independence rules. SASRA published its 2026 list on 13 March 2026.
What do the CBK draft risk management guidelines propose?
Draft, not yet in force. Status as of 16 October 2026; comments are due 7 November 2026. The package released on 10 September 2026 would replace the 2013 Prudential and Risk Management Guidelines and introduce a framework for domestic systemically important banks.
Is Kenya still on the FATF grey list?
Yes. Kenya has been under FATF increased monitoring since February 2024 and remained on the list after the June 2026 plenary. Remaining actions include risk-based supervision, beneficial ownership and targeted financial sanctions.
Can FNJ act as our outsourced internal audit or compliance function?
Yes. We run fully outsourced or co-sourced internal audit and compliance functions, report to your board or audit committee, and can track findings and obligations in Trigarc.
Talk to our risk and compliance team
Tell us your licence type and your deadline. We reply within one working day and send a proposal within 1 to 4 working days.