Kenya AML for Accountants: POCAMLA and FRC Registration

In Kenya, accountants are covered by the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) as reporting institutions, and the Financial Reporting Centre (FRC) is the body that supervises them. The Proceeds of Crime and Anti-Money Laundering Regulations, 2023 added detailed rules on registration, risk assessment, due diligence, reporting and compliance reporting. This guide sets out what the Act and the Regulations say, using the text published on the Kenya Law website together with the Institute of Certified Public Accountants of Kenya (ICPAK) announcement on FRC registration. It is general information, not legal advice. The Act's schedules were not available to us, so details that depend on them are flagged.

Who is covered and who supervises

Section 2 of POCAMLA defines a reporting institution as a financial institution, a designated non-financial business or profession (DNFBP) or a virtual asset service provider. Accountants fall within the DNFBP definition, which covers accountants who are sole practitioners, partners or employees in professional firms. Auditors are not named separately, so auditors should confirm with the FRC or ICPAK how their work is treated. Kenya Law shows the Act's most recent amendment as the Virtual Asset Service Providers Act (Act No. 20 of 2025), applied on 4 November 2025.

Section 36A gives the FRC general power to regulate and supervise all reporting institutions. It also requires supervisory bodies to supervise and enforce compliance by the institutions they oversee, and section 24 lets the FRC order inspections. ICPAK's page on the FRC sensitisation forum describes ICPAK as the statutory body regulating the accountancy profession and records that it negotiated with the FRC over registration. It states that section 36A makes the FRC the supervisor of all reporting institutions.

Registration with the FRC

Regulation 5 of the 2023 Regulations requires reporting institutions to register with the FRC in the manner and within the time it sets, and to notify changes within 90 days. Failure to register is an offence. ICPAK reports that on 5 September 2023 the FRC directed several categories of entity, including accounting firms, to register, with an original deadline of 15 September 2023 that was extended to 2 October 2023. If your practice has not registered, check the FRC's current requirements straight away.

Risk assessment and due diligence

The Regulations require institutions to assess and document their risks, have the board approve controls, and update the assessment at least every two years. A risk assessment is required before new products, practices or technologies are launched, and policies must address non-face-to-face relationships. Anonymous or fictitious accounts are prohibited. Institutions must identify and verify customers and beneficial owners, understand the purpose of the relationship and monitor it on an ongoing basis. Verification should generally be completed before or during the relationship, and later only if risks are managed and delay would disrupt business.

Simplified due diligence is allowed for lower-risk customers but not where there is suspicion, and enhanced due diligence applies to higher-risk cases, including source-of-funds checks and senior management approval. For companies, the controlling natural person must be identified through ownership, other control, or, as a last resort, the senior managing official. For trusts, the settlor, trustees, protector, beneficiaries and any other controlling person must be identified. Our guide to customer due diligence for accountancy practices explains the general process.

Internal controls, records and annual reports

• Money laundering reporting officer. A management-level reporting officer is required, and the appointment or removal must be communicated within 14 days.
• Training and audit. The Regulations require employee training and an independent audit function.
• Record keeping. Section 46 and regulation 42 require records to be kept for at least seven years.
• Annual compliance report. Regulation 44 requires an annual compliance report by 31 January of the following year.

Reporting suspicion, cash and cross-border movements

Section 44 requires institutions to monitor complex or unusual transactions and to report suspicion to the FRC within two days after the suspicion arose. Attempted transactions are also reportable, and regulation 41 prohibits tipping off. Regulation 40 requires cash transactions of US$15,000 or more to be reported to the FRC, generally by the end of the week in which they occur, and regulation 10 requires cross-border movements of monetary instruments of US$10,000 or more to be declared to customs. The Act sets the cash reporting threshold by reference to a schedule we could not read, so check the current figure. Section 48 also makes the obligations apply to accountants, lawyers and certain trust and company service providers.

Penalties

Under section 11, failing to meet the requirements of sections 44 to 47A or the related regulations is an offence. Section 16(2) provides, for a natural person, imprisonment of up to seven years, a fine of up to KES 2.5 million, or both, and for a body corporate a fine of up to KES 10 million or the value of the property involved, whichever is higher. Section 24B lets the FRC impose civil penalties of up to KES 5 million for individuals and KES 25 million for corporate bodies, plus KES 10,000 per day of continued failure for up to 180 days. Regulation 48 separately makes contravention of the Regulations an offence, with a fine of up to five million shillings, imprisonment of up to three years, or both. The money laundering offences in sections 3 and 4 carry up to 14 years' imprisonment.

Practical steps

These are our suggestions, not requirements in the Act:

• Confirm your firm's FRC registration and keep the confirmation on file.
• Appoint and notify a reporting officer, and diarise the 31 January annual report.
• Write the two-day reporting rule into your escalation procedure so staff know the clock starts when suspicion arises.
• Review your risk assessment at least every two years and before launching new services.
• Keep records for seven years, and keep the evidence behind beneficial ownership decisions.
• Check the current text of the Act and the FRC's guidance, since amendments continue.

For how another African jurisdiction handles the same duties, see our guide to Nigeria's AML rules for accountants and to South Africa's framework.

Frequently asked questions

Does ICPAK supervise my AML compliance?

Section 36A makes the FRC the general supervisor of reporting institutions. It also requires supervisory bodies to supervise and enforce compliance for institutions they oversee, so check the FRC and ICPAK's current arrangements for your firm.

How quickly must I report suspicion?

Within two days after the suspicion arose, under section 44(2) and regulation 38(1).

Are auditors covered?

The definition of DNFBP names accountants but not auditors. Confirm with the FRC how audit work is treated.