Two days, one narrative, one file
An STR is judged three times. Your MLRO judges it first. An analyst at the Financial Reporting Centre (FRC) reads it next. Months later, a Central Bank of Kenya (CBK) examiner pulls the file. Most STRs fail that third test. The report went in, but nobody can show when the suspicion arose, why the institution reached it, or what happened to the alerts it chose not to report.
The clock is short. Section 44(2) of the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) and regulation 38 of the POCAMLA Regulations 2023 both require the report “within two days after the suspicion arose.” Since the 2023 amendments, that one duty covers suspicion of money laundering, terrorism financing, proliferation financing and proceeds of crime. The law does not say two working days. It does not start the clock when the MLRO signs. If your process cannot show the date suspicion arose, you cannot show you met the deadline.
When does suspicion arise? Not when the system generates an alert. Most alerts turn out to be legitimate activity, and international practice treats an alert as the start of a review, not as suspicion. The US Financial Crimes Enforcement Network (FinCEN), for example, starts its filing clock when the reviewer with decision authority concludes the activity is suspicious. Take the same position, tightened for Kenya’s shorter deadline: suspicion arises on the date the analyst or investigator, after a documented review, concludes there are reasonable grounds to suspect and escalates the case to the MLRO. That date starts the two days. Two conditions keep the position defensible. First, alert reviews must run to a written timeline, so an alert cannot sit unworked to hold the clock back. Second, when a staff member refers a case that already states a suspicion, the clock starts on the day of that referral.
Two days, or forthwith? The Regulations add a tighter expectation: regulation 12(6) requires the MLRO to report to the FRC “forthwith.” Read together, the Act sets two days as the legal outer limit, and the Regulations tell the MLRO not to treat that limit as a buffer. Once the MLRO confirms suspicion, file the same day wherever possible.
This matters now. Kenya remains on the Financial Action Task Force (FATF) list of jurisdictions under increased monitoring, and its action plan includes stronger risk-based supervision. Since 2023, CBK has been able to penalize any POCAMLA breach directly. Examiners arrive with sample lists and can pull a case file the same day. The STR file has to stand on its own.
This guide applies to every institution CBK supervises for AML/CFT: banks, mortgage finance and mortgage refinance companies, microfinance banks, money remittance providers, forex bureaus, non-deposit taking credit providers (formerly digital credit providers), payment service providers, credit guarantee companies and virtual asset service providers. Insurance Regulatory Authority (IRA) and Capital Markets Authority (CMA) licensees carry the same POCAMLA reporting duties; their penalty regimes are in the second table below.
What the law requires and what gets tested
| Requirement | What is tested | Legal anchor |
|---|---|---|
| Monitor complex, unusual, suspicious and large transactions | Scenarios match your risk assessment; alerts are worked, not parked | POCAMLA s.44(1) |
| Examine background and purpose; record findings in writing | A written analysis for every escalated alert, including those not reported | s.44(4) |
| Keep findings for at least seven years; make them available | Retrieval on request for FRC, CBK or auditors | s.44(5); reg 42 |
| Report within two days after suspicion arose | Timestamps for internal referral, MLRO decision and filing | s.44(2); reg 38 |
| Report attempted transactions | Declined onboardings and aborted transactions considered for reporting | s.44(3); reg 25(2)(e) |
| State the nature of and reason for the suspicion; attach documents | Narrative quality; supporting records attached | reg 38; s.44(7) |
| Answer FRC requests for further information within 30 days | A request log against the deadline | s.44(8)–(9) |
| All staff report suspicion to the MLRO; MLRO acts promptly | Referral channel, referral log, staff awareness | reg 12(5)–(7) |
| Do not tip off | Frontline scripts; restricted access to STR records | s.8; reg 41 |
The exposure is real on both tracks. On the criminal side, a reporting institution that fails to comply with s.44 commits an offense under s.11(1). Tipping off is an offense under s.8. Both carry, under s.16(2), up to seven years’ imprisonment or a fine of up to KES 2.5 million (or both) for an individual, and a fine of up to KES 10 million or the value of the property involved, whichever is higher, for a body corporate. Officers who consent to or connive in the offense can be prosecuted alongside the institution (s.16(6)).
On the administrative side, the penalty depends on the licence and the supervisor:
| Institution | Licensing law | Provision | Maximum penalty |
|---|---|---|---|
| Banks, mortgage finance companies | Banking Act | s.33E | KES 20M legal person; KES 1M natural person; plus KES 100,000 per day continuing |
| Payment service providers | National Payment System Act | s.17B | KES 20M legal person; KES 1M natural person; plus KES 100,000 per day continuing |
| Insurers and other IRA licensees | Insurance Act | s.196C | KES 20M legal person; KES 1M natural person; plus KES 100,000 per day continuing |
| Microfinance banks | Microfinance Act | s.36C | KES 5M legal person; KES 1M natural person; plus KES 100,000 per day continuing |
| Money remittance providers, forex bureaus, non-deposit taking credit providers | Central Bank of Kenya Act | s.51B | KES 5M legal person; KES 1M natural person; plus KES 100,000 per day continuing |
| Mortgage refinance companies, credit guarantee companies | Central Bank of Kenya Act | s.4A(1)(h) | Under CBK AML/CFT supervision; no class-specific AML penalty provision |
| Virtual asset service providers (licensed by CBK or CMA) | Virtual Asset Service Providers Act 2025 | s.39 | Warnings, directions, licence suspension or revocation; fines of up to KES 10M (company) or KES 3M (individual) for specified breaches |
| CMA licensees | Capital Markets Act | s.12B | Power to impose monetary, civil or administrative sanctions; no AML-specific cap in the Act |
The protection is real too. Section 19 bars proceedings against an institution and its staff for acts done “with due diligence and in good faith” under the Act. A well-documented file is how you prove both.
Checklist you can run this week
The clock
- A written definition of when suspicion “arises” in your institution, approved by the board committee.
- Timestamps captured for alert generation, first-line referral, analyst escalation, MLRO decision and filing.
- A deputy MLRO with goAML access and cover for weekends and public holidays.
The narrative
- Every STR answers: who, what, when, how much, how, and why it does not fit what you know about the customer.
- Plain facts, not labels. “Unusual activity noted” is not a reason.
- KYC records, statements and correspondence attached, as s.44(7) requires.
The decisions
- A written, approved rationale for every escalated alert that was not reported.
- Declined onboardings and aborted transactions logged and assessed for reporting.
- A separate relationship decision after each STR: retain with enhanced monitoring, restrict or exit. Exiting never replaces the report.
Confidentiality
- Frontline scripts for blocked or delayed transactions that do not mention compliance reviews or reports.
- STR records held with access limited to named staff.
Quality
- Monthly quality review of a sample of STRs and no-file decisions.
- FRC requests logged against the 30-day limit.
Failures that keep recurring
| Finding | What it looks like | Evidence that answers it |
|---|---|---|
| Late filing | Alert open for three weeks; STR filed two days after the MLRO’s “decision” | Case log showing the date suspicion arose and the filing date |
| Narrative repeats the alert | “Customer transacted above profile” and nothing more | Facts, pattern, the customer’s known profile and what you checked |
| No record of non-filings | Alerts closed “no further action” with no reasoning | Written analysis under s.44(4), approved and retained |
| Attempted transactions missed | Declined account openings never considered for an STR | Declined-case log with a reporting decision for each |
| Defensive filing | High STR volumes, thin content, filing to be safe | Quality scores and clear grounds in each report |
| Repeat STRs, no action | Several STRs on one customer; relationship unchanged | A relationship review after each STR |
| Tipping-off risk | Branch staff explain a block by citing a compliance report | Scripts, training records, access controls |
| FRC follow-ups answered late | No log of requests or responses | Request log showing responses within 30 days |
Steps to fix it
- Map the clock. Trace five recent STRs from first alert to filing. Mark where suspicion actually arose and count the days.
- Write the trigger. Define when suspicion arises, who decides, and how that moment is recorded. Get it approved.
- Rebuild the template. Structure the narrative around the six questions: who, what, when, how much, how, and why.
- Fix the no-file record. Require a written rationale and second-level sign-off for every escalated alert closed without a report.
- Close the attempted-transaction gap. Route declined onboardings and aborted transactions to the MLRO for a reporting decision.
- Train the front line. Cover how to refer, what to say to customers, and what never to say.
- Report to the board. Give the committee STR volumes, timeliness, quality scores and open FRC requests every quarter.
- Test before CBK does. Pull ten recent STRs and ten no-file decisions. Ask whether each file shows when, why and what next. Fix what fails.
From practice
Spotting unusual activity is the easy part. What my years as an MLRO have taught me is that explaining why it warrants suspicion is harder. Alerts, unusual payment patterns, inconsistent customer explanations and gaps in documentation each raise questions, but none is a substitute for sound analysis. The work is to examine the facts, weigh the customer’s circumstances and connect the indicators into a coherent narrative. A defensible STR does not simply report what happened. It explains why the activity gives rise to suspicion, without overstating the evidence or presenting assumptions as facts.
Next step
The Riskill toolkits include templates for STR narratives, no-file rationales and an MLRO case log built around the two-day clock: riskilled.com/toolkits. If you want an independent review of your STR files before the next inspection, talk to the advisory desk: riskilled.com/engage.