A name on a form is not a beneficial owner
Most beneficial ownership files record who the customer says owns it. Few show who actually does. A shareholder list, a director’s ID and a tick in the “beneficial owner” box is not identification. It is transcription.
The law asks for more. Section 45(4)(b) of the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) requires you to “identify and verify the identity of the beneficial owner” using reliable information. The POCAMLA Regulations 2023 define a beneficial owner as “a natural person who ultimately owns or controls a customer.” A company is never the answer. Neither is a nominee.
This matters now. Kenya remains on the Financial Action Task Force (FATF) list of jurisdictions under increased monitoring. One of its seven open action items is about beneficial ownership: designate a regulator for trusts, collect accurate and up-to-date ownership information, and act on breaches of transparency rules for legal persons and arrangements. Expect supervisors to test whether your files would survive the same question. Since 2023, the Central Bank of Kenya (CBK) has been able to penalize any POCAMLA breach directly.
This guide applies to every institution CBK supervises for AML/CFT: banks, mortgage finance and mortgage refinance companies, microfinance banks, money remittance providers, forex bureaus, non-deposit taking credit providers (formerly digital credit providers), payment service providers, credit guarantee companies and virtual asset service providers. Insurance Regulatory Authority (IRA) and Capital Markets Authority (CMA) licensees carry the same POCAMLA duties; their penalty regimes are in the second table below.
What the law requires and what gets tested
| Requirement | What is tested | Legal anchor |
|---|---|---|
| Identify and verify the beneficial owner from a reliable source | A named natural person and the evidence used to verify them | POCAMLA s.45(4)(b); reg 14(2)(b) |
| Establish whether the applicant acts for someone else | Nominee, agent and trustee relationships identified | s.45(4)(a); reg 13(2) |
| Understand the ownership and control structure | A structure chart or narrative down to the natural person | reg 14(2)(b) |
| Apply the cascade: ownership, then control by other means, then senior managing official | The reason each step was reached, recorded | reg 16(2) |
| Identify trust parties: settlor, trustees, protector, beneficiaries, anyone with ultimate control | Trust deed reviewed; every party named | reg 18(2), 18(4) |
| Verify before or during onboarding | Dates of verification against account opening | reg 25(3)–(4) |
| If identity is not provided, do not proceed and file an STR | Declined cases with STR decisions | reg 25(2) |
| Screen beneficial owners for PEP status | PEP screening covers owners, not just signatories | reg 26(1)(a) |
| Keep CDD information current | Review dates, trigger events, refreshed files for higher-risk customers | reg 14(6); reg 35(b) |
| Life insurance: identify and verify the beneficial owner of a higher-risk beneficiary that is a legal person or arrangement | Checks completed at payout, before funds are released | reg 24(4) |
The POCAMLA Regulations set no percentage for “controlling ownership interest.” The Companies (Beneficial Ownership Information) Regulations do. A company must record anyone who holds at least 10% of its shares or voting rights, directly or indirectly, can appoint or remove a majority of the board, or exercises significant influence or control (reg 3(2)). That is the company’s filing duty, not your CDD threshold, but it is the right baseline. Use 10% for standard-risk customers: your file and the registry then answer the same question and can be reconciled. For higher-risk customers, drop to 5% and look for control by other means at every layer. Kenya’s 10% is already well below the 25% used as the example in the FATF standards and as the EU baseline; 5% applies the same logic of a lower threshold where risk is higher. Write both thresholds into policy and get them approved.
Administrative penalties for any POCAMLA breach depend on the licence and the supervisor:
| Institution | Licensing law | Provision | Maximum penalty |
|---|---|---|---|
| Banks, mortgage finance companies | Banking Act | s.33E | KES 20M legal person; KES 1M natural person; plus KES 100,000 per day continuing |
| Payment service providers | National Payment System Act | s.17B | KES 20M legal person; KES 1M natural person; plus KES 100,000 per day continuing |
| Insurers and other IRA licensees | Insurance Act | s.196C | KES 20M legal person; KES 1M natural person; plus KES 100,000 per day continuing |
| Microfinance banks | Microfinance Act | s.36C | KES 5M legal person; KES 1M natural person; plus KES 100,000 per day continuing |
| Money remittance providers, forex bureaus, non-deposit taking credit providers | Central Bank of Kenya Act | s.51B | KES 5M legal person; KES 1M natural person; plus KES 100,000 per day continuing |
| Mortgage refinance companies, credit guarantee companies | Central Bank of Kenya Act | s.4A(1)(h) | Under CBK AML/CFT supervision; no class-specific AML penalty provision |
| Virtual asset service providers (licensed by CBK or CMA) | Virtual Asset Service Providers Act 2025 | s.39 | Warnings, directions, licence suspension or revocation; fines of up to KES 10M (company) or KES 3M (individual) for specified breaches |
| CMA licensees | Capital Markets Act | s.12B | Power to impose monetary, civil or administrative sanctions; no AML-specific cap in the Act |
Your customer has its own exposure. A company that never lodged its beneficial ownership register commits an offense carrying a fine of up to KES 500,000 for the company and for each officer in default, and up to KES 50,000 a day if the failure continues after conviction (Companies Act s.93A(10)–(11)). Late filing of a change costs KES 2,000 plus KES 100 a day (s.93A(8)–(9)). A nominee who hides their nominator commits an offense (Companies BO Regulations reg 4A(6)). A customer that cannot show a lodged, current register is a risk signal in its own right.
What the registry gives you, and what it doesn’t
The Registrar can let financial institutions search the beneficial ownership register on Form BOF6, for a KES 600 fee, but the result excludes protected personal information such as ID numbers and dates of birth (Companies BO Regulations reg 14(1)(c)). A company may also hand its own register to a financial institution when entering into a relationship with it (reg 13(2)(d)). Limited liability partnerships keep and lodge a register too (Limited Liability Partnership Act s.31B). The POCAMLA Regulations accept data “from a public register, the customer or other reliable sources” (reg 22(4)).
Use the register. Do not stop there. It records what the company filed, and it gives you names, not verified identities, so you still verify each owner yourself. If it conflicts with what the customer told you, that conflict is the finding. Only the company or the owner can report a material discrepancy to the Registrar (Form BOF8, reg 17); financial institutions have no route of their own. So ask the customer to correct its filing, rely on neither version until it is resolved, record the outcome, and consider an STR where the explanation does not hold.
There is no equivalent register for trusts; Kenya’s FATF action plan still calls for a trust regulator. For trusts, the deed and the trustee’s declaration are your primary evidence. For partnerships, regulation 17 of the POCAMLA Regulations sets the particulars to collect; for other legal arrangements, identify the persons in positions equivalent to settlor, trustee and beneficiary (reg 18(4)(b)).
Checklist you can run this week
Policy
- A written ownership threshold: 10% for standard-risk customers, 5% for higher-risk customers.
- The cascade written into procedure, with the senior managing official as the last step, not the default.
- A rule for what happens when the owner cannot be identified: no account, and an STR decision.
Onboarding
- A structure chart for every layered customer, down to natural persons.
- Beneficial owners verified from a reliable source, not just the customer’s declaration.
- Registry search results on file, with any conflict recorded and resolved.
- Trust deeds obtained and every party named.
Screening
- PEP and sanctions screening runs on beneficial owners and controllers, not only on signatories.
Ongoing
- Customers asked to tell you of ownership changes. Owners must tell the company within 14 days (Companies BO Regulations, reg 3(5C)); make your contract ask for the same.
- Ownership refreshed at each periodic review and on trigger events: new directors, share transfers, unusual third-party payments.
Failures that keep recurring
| Finding | What it looks like | Evidence that answers it |
|---|---|---|
| Owner is a company | “Beneficial owner: XYZ Holdings Ltd” | Chain traced to the natural person, with documents at each layer |
| Default to the senior managing official | CEO recorded as owner with no ownership analysis | Recorded reasons why ownership and other control were exhausted |
| Declaration only | Customer’s self-declaration is the only evidence | Registry search, share register or other reliable source on file |
| Nominees missed | Shareholder of record acts for an unnamed principal | Nominee question asked; principal identified and verified |
| Trusts half-done | Trustee named; beneficiaries and settlor missing | All parties under reg 18(4), from the trust deed |
| Owners not screened | PEP screening covers signatories only | Screening log showing owners and controllers |
| Stale files | Ownership last checked at onboarding years ago | Review dates and trigger-event refreshes |
| Accounts opened first | Verification “to follow” with no deadline | Verification date before or during onboarding, or a documented reg 25(4) exception |
Steps to fix it
- Set the threshold. Adopt 10% for standard-risk customers and 5% for higher-risk ones. Get both approved.
- Write the cascade. Spell out each step of reg 16(2) and what evidence closes it.
- Build the structure chart. Require one for every customer with more than one layer of ownership.
- Add the registry search. Make a BOF6 search or a copy of the company’s own register part of onboarding for Kenyan companies, and record conflicts.
- Fix trusts. Require the deed and name every party in reg 18(4).
- Extend screening. Run PEP and sanctions screening on every beneficial owner and controller.
- Remediate the back book. Start with high-risk corporates and trusts. Track progress monthly.
- Test before CBK does. Pull ten corporate files. Ask whether each names a natural person, shows how they were verified, and shows when that was last checked.
From practice
As an MLRO, I have learned that a declaration or an ownership chart rarely settles beneficial ownership. Corporate structures can hide the natural persons behind intermediate shareholders. Declarations often need reconciling against the underlying company records. And shareholding percentages do not always show who actually exercises control. The real task is not to record who is named as the beneficial owner, but to establish, through credible and consistent evidence, who ultimately owns or controls the customer.
Next step
The Riskill toolkits include CDD templates for legal persons and arrangements: riskilled.com/toolkits. For an independent review of your beneficial ownership files or back-book remediation plan, talk to the advisory desk: riskilled.com/engage.