Readiness is decided before the notice arrives
By the time the Central Bank of Kenya’s (CBK) inspection notice lands, most of the outcome is already fixed. Examiners test what your institution did over the review period, not what it can assemble in a fortnight.
Some inspections come with a notice period. Others come with none: the notice is handed over the morning the examiners arrive. Since Kenya’s grey-listing, these same-day inspections have become more frequent, and I have been through one as a money laundering reporting officer (MLRO).
Either way, examiners test evidence that already exists. A control that ran but left no record will be treated as a control that did not run. A policy approved after the notice date will be read as a gap you found, not a gap you closed.
This applies to every institution CBK supervises for AML/CFT: banks, mortgage finance and mortgage refinance companies, microfinance banks, money remittance providers, foreign exchange bureaus, non-deposit taking credit providers (formerly digital credit providers), payment service providers, credit guarantee companies and virtual asset service providers. Insurance Regulatory Authority (IRA) and Capital Markets Authority (CMA) licensees carry the same obligations and are inspected by their own supervisor; the evidence pack below works for them too. This guide sets out what examiners ask for, the evidence that answers each request, the findings that recur, and what to do when the notice arrives, whether that is today or in a fortnight.
What CBK examiners ask for
The request list follows the obligations in the law, so build your evidence pack around the same structure. The 2023 AML/CFT amendments gave CBK express powers to inspect, compel documents and impose penalties at every institution it licenses, and gave IRA and CMA matching sanction powers. The penalty sits in the law your institution is licensed under, shown in the table below. The Proceeds of Crime and Anti-Money Laundering Regulations, 2023 set out what examiners test against.
| Institution | Supervisor | Licensing law | Penalty for a breach (maximum) |
|---|---|---|---|
| Banks, mortgage finance companies | CBK | Banking Act | KES 20 million per institution; KES 1 million per individual (section 33E) |
| Payment service providers | CBK | National Payment System Act | KES 20 million per institution; KES 1 million per individual (section 17B) |
| Microfinance banks | CBK | Microfinance Act | KES 5 million per institution; KES 1 million per individual (section 36C) |
| Money remittance providers, foreign exchange bureaus, non-deposit taking credit providers | CBK | Central Bank of Kenya Act | KES 5 million per institution; KES 1 million per individual (section 51B) |
| Mortgage refinance companies, credit guarantee companies | CBK | Central Bank of Kenya Act (section 4A(1)(h)) | No class-specific AML penalty provision |
| Virtual asset service providers | CBK or CMA | Virtual Asset Service Providers Act, 2025 | Warnings, directions, licence suspension or revocation; fines of up to KES 10 million per company or KES 3 million per individual for specified breaches (section 39) |
| Insurers and other IRA licensees | IRA | Insurance Act | KES 20 million per institution; KES 1 million per individual (section 196C) |
| CMA licensees | CMA | Capital Markets Act | Monetary, civil or administrative sanctions; no AML-specific cap (section 12B) |
The Banking, National Payment System, Microfinance, Central Bank of Kenya and Insurance Acts each add up to KES 100,000 for every day a breach continues. The penalties reach directors, officers and agents, not only the institution.
| Request area | What examiners test | Legal anchor |
|---|---|---|
| Institutional risk assessment | Covers customers, products, channels and geography; updated within two years; drives your controls | Regulation 7 |
| Policies and procedures | Board-approved, current, and matched by what staff actually do | Regulation 11 |
| MLRO appointment | Management-level appointee; CBK and the Financial Reporting Centre (FRC) notified within 14 days | Regulation 12 |
| Customer due diligence | Identity and beneficial owner verified; purpose of relationship understood; files reviewed on a risk basis | Regulation 14 |
| Enhanced due diligence and PEPs | Senior management approval, source of funds and wealth, enhanced monitoring | Regulations 20 and 26 |
| New products and technologies | Risk assessed before launch, not after | Regulation 8(2) |
| Suspicious transaction reports | Filed within two days of suspicion arising; decisions documented | Section 44(2); Regulation 38 |
| Cash transaction reports | Every cash transaction of USD 15,000 or more reported by the end of that week | Regulation 40 |
| Sanctions screening | Customers and payments screened against UN and domestic lists; hits resolved and recorded | Prevention of Terrorism Act |
| Record keeping | Transaction and CDD records kept for at least seven years | Regulation 42 |
| Training | Ongoing program, attendance records, content matched to roles | Regulation 11(c) |
| Independent audit | AML/CFT tested by a function independent of compliance | Regulations 11(d) and 43 |
Expect the request list to arrive with the notice, with a short deadline. Expect examiners to also ask for board and committee minutes, MLRO reports to the board, and the status of findings from the last inspection.
The evidence checklist: run it now
Run this checklist every quarter, not after the notice. In a same-day inspection, it is all you will have. Each item asks whether you can produce the evidence within a day, not whether the control exists.
Governance
- Board approval of the current AML/CFT policy, with the minute reference and date
- Institutional risk assessment dated within the last two years, with board sign-off
- MLRO appointment letter and the notification sent to CBK and the FRC
- MLRO reports to the board for the review period, and the board’s recorded response
Customers
- Customer risk-rating methodology, and evidence that every active customer carries a rating
- A sample of high-risk and PEP files, each with senior management approval and source of funds
- Beneficial ownership verified to the natural person on every corporate file you would sample
- Periodic review dates met for high-risk customers, with exceptions logged
Monitoring and reporting
- Transaction monitoring rules, with the date and rationale of the last calibration
- Alert log showing every alert closed, with a reason a reviewer can follow
- STR register reconciled to goAML filings, with time from suspicion to filing
- Cash transaction reports reconciled to the cash ledger for at least one month
- Sanctions screening log showing hits, decisions and who made them
People and assurance
- Training attendance by staff member and role for the review period
- Latest independent AML/CFT audit report and the status of each finding
- Previous CBK inspection findings, each mapped to closure evidence
- Risk assessments for products or channels launched since the last inspection
Findings that recur, and the evidence that answers them
Most AML/CFT findings are not missing controls. They are controls that cannot be shown to work. Each row below pairs a recurring finding with the evidence that prevents it.
| Recurring finding | What it looks like to an examiner | Evidence that answers it |
|---|---|---|
| Stale risk assessment | Dated more than two years ago, or unchanged after a new product, channel or market | Dated update log; board minute adopting the latest version |
| Generic risk assessment | Describes risk categories but not your customers, volumes or exposures | Your own data: customer counts by risk band, product and corridor volumes |
| Policy and practice diverge | Procedure says one thing; files and system settings show another | Walkthrough evidence that staff follow the written steps; version history |
| Incomplete beneficial ownership | Corporate files stop at shareholder entities, not natural persons | Ownership chart to the individual, with verification documents on file |
| Weak EDD on PEPs and high-risk customers | Approval missing or after onboarding; source of funds asserted, not verified | Dated approvals before account activation; documents supporting source of funds |
| Alerts closed without reasons | “No issue” closures with no analysis a reviewer can follow | Closure notes that state what was checked and why it was cleared |
| Late or thin STRs | Days or weeks between first red flag and filing; vague narrative | Case timeline from first alert to filing; narrative that answers who, what, why suspicious |
| Untested screening | No proof the screening system catches listed names | Periodic test results with seeded names; list update logs |
| Training not risk-based | One generic course for all staff; attendance gaps | Role-based modules for frontline, operations and the board; completion tracking |
| Repeat findings | Prior inspection issues still open or closed on paper only | Closure evidence for each finding, verified by internal audit |
When the notice arrives: today or in two weeks
The first hours set the tone of the inspection. Use them to organize, not to fix.
If the examiners arrive with the notice
A same-day inspection rewards institutions whose evidence is already filed and indexed. You have hours, not days.
- Receive the team professionally. Give them a room, confirm the scope and request list in writing, and agree when the first items are due.
- Call the MLRO, the CEO and the head of operations immediately. Name the MLRO as the single point of contact.
- Sort the requests by what examiners need today. Policies, the risk assessment and system access usually come first; samples follow.
- Assign one person per request area. Each retrieves existing records from the system or file; nobody drafts anything new.
- Hand over nothing without logging it. Record what was given, to whom and when.
- Brief frontline staff. Examiners may walk the floor or call branches and agents. Staff should answer honestly and refer document requests to the MLRO.
If you get a notice period
- Name one inspection lead. Usually the MLRO. Every request, response and document goes through that person.
- Brief the CEO and board chair the same day. They should hear the scope and dates from you, not from the examiners.
- Log the request list. One register: request, owner, due date, status, document reference. Examiners notice when responses are tracked.
- Collect, do not create. Pull existing evidence for each request. Do not backdate, re-sign or rewrite anything.
- Record known gaps honestly. Where evidence is missing, write down the gap and the remediation already planned. Disclosed gaps read better than discovered ones.
- Prepare the people. Walk relationship managers, operations and the MLRO through how their process works and where its evidence sits.
- Set up the working room. One shared folder, indexed to the request list, and a quiet room with access to systems.
During and after the inspection
Treat the inspection as a structured conversation with a record. Three disciplines matter.
- Answer what was asked. Give the requested document, labeled to the request number. Volunteering unrelated material widens scope and slows the work.
- Correct errors on the day. If an examiner misreads a file or a process, show the evidence while they are on site. A draft finding is cheaper to fix than a final one.
- Keep your own record. Log every meeting, request and verbal observation. It becomes your reference when the draft report arrives.
When the report arrives, respond finding by finding. Each management response should accept or contest the finding with evidence. The corrective action plan should name an owner, a date and the evidence that will prove closure. Then track it to closure and have internal audit verify it. Repeat findings at the next inspection cost more than the first ones did.
In my years as an MLRO, I have seen that inspection outcomes rarely turn on whether policies, procedures and compliance reports exist. They turn on the details: complete customer due diligence records, documented transaction monitoring decisions, reliable system audit trails, and earlier deficiencies that have actually been fixed. A well-written AML framework counts for little unless the institution can show, with credible evidence, that it works in practice.
Regulators have more reason to be strict now. Kenya has been on the Financial Action Task Force (FATF) list of jurisdictions under increased monitoring since February 2024, and stayed on it at the June 2026 review. One of the actions FATF still requires is stronger risk-based supervision of financial institutions. And CBK can now penalize the institution and its officers directly, under the provisions set out in the first table above. IRA and CMA can sanction their licensees under the laws in the same table.
Close: be inspection-ready every quarter
An institution that runs the checklist above every quarter does not prepare for inspections. It hands over what it already has.
Riskill’s AML/CFT/CPF Inspection Readiness Toolkit packages this work: a readiness checklist, an evidence request list, a control self-assessment, a gap matrix, a corrective action plan and a board brief. For an independent readiness review before the notice arrives, talk to the advisory desk.