Building an AML-ready KYC onboarding workflow in Kenya

Customer due diligence (CDD) at onboarding usually starts with confirming a company exists and matching its registration details. That step is necessary, but on its own it answers the wrong question. A functioning AML programme also needs to know who actually controls the company, whether the business's own compliance filings are current, and whether the counterparty or its directors carry other risk signals — litigation, procurement debarment, adverse media.

Beneficial ownership is a filed legal requirement, not best practice

Under Section 93A of the Companies Act, 2015 (introduced by a 2019 amendment) and the Companies (Beneficial Ownership Information) Regulations, 2020, every company and limited liability partnership registered in Kenya must:

• Identify its beneficial owners and keep an internal register at its registered office, recording full name, nationality, and the nature of their ownership or control.
• Lodge a copy of that register with the Registrar of Companies electronically via the Business Registration Service (BRS) platform, using Form BOF1, within 30 days of preparing it.
• Notify the Registrar of any change to a beneficial owner's particulars within 14 days.

The Business Registration Service — a state corporation that administers the Companies Act and the Limited Liability Partnerships Act — has been actively enforcing this since a public notice in October 2024. Non-compliance is not a paperwork slip: it carries a fine of up to KSh 500,000 for the company, a further KSh 50,000 for each day the failure continues, and a company that goes five years without filing its annual returns can be struck off the register entirely.

For a screening workflow, that turns "who owns this company" from a manual investigation into a checkable fact: has the beneficial ownership register actually been filed with the BRS, and does it match who the applicant told you controls the business?

What good CDD looks like in a Kenyan onboarding flow

1. Verify legal existence and status against the company registry — not just a name match, since trading names rarely match the registered legal name exactly.
2. Check whether the beneficial ownership register has been filed, and cross-reference the named owners against the directors the applicant disclosed.
3. Screen the company and its directors for litigation, procurement debarment, licence status, and adverse media — a clean registry entry says nothing about any of these.
4. Tier the file by risk: state-linked entities, cash-intensive sectors, and cross-border ownership structures generally warrant a closer look than a small, local, single-owner supplier.

Why the bar keeps rising

Kenya's continued presence on the FATF grey list is part of why beneficial ownership enforcement has tightened rather than loosened — accurate ownership data is explicitly one of the gaps FATF has asked Kenya to close. That pressure flows down through banks and regulated institutions to the onboarding checks they expect their own corporate customers and partners to be able to produce. (See our companion piece on sanctions and PEP screening for how grey-list status changes screening expectations more broadly.)

Making the workflow repeatable

A CDD process that works once is not the same as one that holds up on audit. Two things make the difference:

• Version and date every check. A registry lookup and a beneficial ownership check from six months ago are not the same file as one run today — cite the date and source for each.
• Re-screen on a cadence, not just at onboarding. Ownership changes, new litigation, and new debarment listings all happen after the relationship starts.

Automating the lookups does not remove the compliance officer from the decision — it means the officer is reviewing a complete, dated file instead of assembling one from scratch on every application.

← All insights