Verify before the account opens
Collect and verify the customer's identity from reliable, independent sources before the account can transact. A remote flow has to prove the person behind the selfie matches the document.
Financial services
Financial services / Neobanks
Digital-first banking still carries a full bank's KYC duty.
Kenya has no separate neobank licence. Digital banks either hold a bank or microfinance bank licence themselves, or run their product on a licensed partner bank, which keeps the customer due-diligence obligation and expects the app to meet it.
At a glance
Who sets the rules?
Primary regulator
Central Bank of Kenya (CBK)
Who this covers
App-only banks, digital banking brands of licensed banks, and banking-as-a-service programmes running on a partner bank or microfinance bank.
Regulations that apply
Banking Act (Cap. 488) and CBK Prudential Guidelines
Licensing, governance and the CBK guideline on preventing money laundering: identify and verify every customer before the relationship starts, and apply a risk-based approach.
Microfinance Act, 2006
The same expectations for deposit-taking microfinance banks that operate digital products.
Proceeds of Crime and Anti-Money Laundering Act (POCAMLA), 2009 and its regulations
Customer due diligence, enhanced checks for higher-risk customers and politically exposed persons, suspicious-transaction reporting to the Financial Reporting Centre (FRC) and record keeping.
Prevention of Terrorism Act, 2012
Screening customers against United Nations Security Council and domestic designations, and freezing obligations on a match.
Data Protection Act, 2019
A lawful basis for processing ID documents and selfies, data minimisation, retention limits and registration with the Office of the Data Protection Commissioner (ODPC).
What you have to do
Risk-rate every customer
Assign a risk rating at onboarding and apply enhanced due diligence to higher-risk customers, including politically exposed persons and their close associates.
Screen and keep screening
Check sanctions and PEP lists at onboarding and again when lists change, not just once.
Keep the record
Retain identification evidence and the reviewer's decision for the period the AML rules require (POCAMLA sets at least seven years) so you can show an examiner how each decision was made.
Fraud to watch for
Deepfake and replayed selfies
Face-swap video and screen replays used to pass liveness checks at sign-up.
Synthetic and borrowed identities
Real ID numbers paired with another person's face, or IDs rented from their owners.
Mule accounts
Accounts opened in bulk to receive and move fraud proceeds before they are frozen.
How Sentinel helps
- Remote KYC with document checks, face match and liveness in one flow.
- Sanctions and PEP screening, with matches routed to a named reviewer.
- An exportable record of the evidence and the decision for each customer.
Related reading
23 October 2026 · 5 min read
Kenya and the FATF grey list: what it means for onboarding
Why increased monitoring raises the bar for customer due diligence at banks, SACCOs, PSPs and fintechs, and what a defensible onboarding record looks like.
Read the article 23 October 2026 · 4 min readDeepfakes and remote onboarding: what a liveness check has to prove
Face-swap video and replay attacks are now cheap. What institutions should expect from liveness and document checks, and why the record matters as much as the result.
Read the articleGeneral information, not legal advice. Last reviewed October 2026. Requirements change, so confirm the current position with the regulator or your counsel before relying on it.