Malawi AML Obligations for Accountants: Financial Crimes Act Guide

Malawi regulates money laundering through the Financial Crimes Act (Cap. 7:07, Act 14 of 2017) and the Financial Crimes (Money Laundering) Regulations, 2020 (Government Notice No. 10, published in the Gazette Supplement of 15 May 2020). This guide explains how the two fit together for accountants and finance students who want to see how an African regime treats professional advisers. The Act text we read is shown as at 31 December 2017 with amendments published up to 31 October 2021. For the shared basics, our KYC and customer due diligence guide is a useful companion.

Please read "What we could not confirm" at the end. We did not read every section of either document, and we state no supervisor for accountants because the text does not name one.

Are accountants covered?

Section 2(1) of the Act defines a reporting institution as a financial institution or a designated non-financial business or profession (DNFBP). The DNFBP definition includes legal practitioners, notaries, independent legal professionals and accountants, but only when they prepare for or carry out specified client transactions, such as buying and selling real estate, managing client money, and organising contributions for companies. Trust or company service providers are a separate limb of the definition. In the text we read, auditors are not named as reporting institutions, although external auditors have a duty to report in certain situations under regulation 29 of the Regulations.

Who supervises

The Act defines a supervisory authority as an authority overseeing a reporting institution or profession that the Minister designates by Gazette notice. Section 35(1) requires the Financial Intelligence Authority to ensure that reporting institutions comply. For DNFBPs, section 38 requires self-regulatory bodies to ensure their members comply, and section 39(1) requires those bodies to report suspicions within three days. We did not find the designation notice that names the body for accountants.

Customer due diligence

Section 16 requires institutions to identify and verify customers and beneficial owners using official documents when opening an account or establishing a continuing relationship, among other triggers. Under regulation 4(1), due diligence is required when establishing a continuing business relationship, for an occasional transaction of K2,500,000, for linked transactions within 14 days that together reach the amount in regulation 28 (K5,000,000), for electronic funds transfers of any amount, where money laundering or terrorist financing is suspected, and where previously obtained identification data is doubted. Simplified measures are allowed for low-risk customers (regulation 4(5)) but not where there is suspicion (regulation 4(6)). If identity evidence is not produced, section 19(1) says the institution must not open the account or proceed, and must file a suspicious transaction report within three days.

Beneficial owners and politically exposed persons

Regulation 8(2)(a) treats any person controlling 10% or more of the voting rights of a company as a beneficial owner, with fallbacks to others exercising control, senior management and directors. See our guide to ultimate beneficial ownership for the wider concept. Regulation 7 requires institutions to keep risk management systems to identify politically exposed persons, obtain senior management approval before establishing or continuing the relationship, apply enhanced ongoing monitoring, and take reasonable steps to establish source of wealth and funds. It also covers family members and close associates.

Reporting and tipping off

Section 23(1) requires a suspicious transaction report "as soon as possible but not later than three days after forming that suspicion", and where possible before the transaction. The Authority may direct a freeze for up to 90 working days (section 23(4)). Section 24(1) prohibits disclosing that a report has been or may be made, and section 24(3) provides for up to 10 years' imprisonment where a disclosure is likely to prejudice an investigation. Our guide to suspicious activity reports and tipping off compares the UK approach.

Record keeping

Section 22(2) and regulation 19 require records to be kept for a minimum of seven years, counted from the latest of the date identity evidence was obtained, the last transaction or correspondence, or the closure of the account or end of the relationship. Regulation 19(5) says records must be reviewed for accuracy annually for high-risk customers and at least every three years for others.

Compliance officer, training and controls

Regulation 30 requires a compliance officer who acts on internal suspicious disclosures, has access to all relevant information and acts independently. The appointment needs approval from the Authority or the supervisory authority, and removal must be notified within 7 days. Regulation 31 requires internal AML rules, training in recognising and handling suspicious transactions, and an independent audit of the compliance programme. Regulation 18 requires a written, board-approved customer acceptance policy, updated annually or when new developments arise.

Penalties as stated in the text

For failing to file a suspicious transaction report, section 23(6) provides 5 years' imprisonment and a fine of K10,000,000 for a natural person, or a fine of K50,000,000 and revocation of the business licence for a legal person. Section 24(2) sets the same figures for tipping off, and section 22(6) for record-keeping breaches. Regulation 38 sets administrative penalties of up to K100,000,000 for reporting institutions and up to K10,000,000 for board members or senior management, after a written notice of up to ten working days.

Our suggestions for a Malawian practice

These are our own suggestions, not legal requirements. Before taking an engagement, check whether it involves one of the transaction types in section 2(1)(e), since the coverage is activity based. Keep one retention schedule with the seven-year period. For structured study, see our CPD courses.

Frequently asked questions

How quickly must a suspicion be reported?

According to section 23(1), as soon as possible and not later than three days after the suspicion is formed.

How long are records kept?

At least seven years under section 22(2) and regulation 19.

Are auditors reporting institutions?

Not by name in the text we read. Accountants are covered for the specified transactions only.

What we could not confirm

The Act text we could read stopped after section 55, and the Regulations page stopped partway through the Fifth Schedule, so we did not read the later sections, the DNFBP-specific schedules in full, or any guidance from the Financial Intelligence Authority. We did not confirm which body supervises accountants, nor amendments after October 2021. The Regulations cite 2019 in one place and 2020 in the title, so check the Gazette. This post is general information, not legal advice.