Kenya and the FATF grey list: what it means for onboarding

In February 2024 the Financial Action Task Force (FATF) placed Kenya under increased monitoring, the list commonly called the grey list. It means Kenya committed to an action plan to fix strategic weaknesses in how it prevents money laundering and terrorist financing. Check FATF's latest plenary statement for Kenya's current status.

Grey listing is a country-level finding, but it lands on individual institutions. Correspondent banks, investors and partners outside Kenya apply more scrutiny to Kenyan counterparties, and domestic supervisors look harder at how institutions apply their own rules.

What supervisors and partners are looking for

The themes are consistent across regulators:

• Risk-based customer due diligence that is actually applied, not just written in a policy.
• Beneficial ownership: knowing the people who own and control business and group customers.
• Sanctions and politically-exposed-person screening at onboarding and on an ongoing basis.
• Suspicious-transaction reporting to the Financial Reporting Centre that is timely and well evidenced.
• Records that show what was checked, who decided, and why.

Who is affected

Banks and digital banks under the CBK, SACCOs under SASRA, payment service providers and the newer categories of reporting institutions all feel it. So do fintechs that are not reporting institutions themselves, because their partner bank passes the requirements down by contract.

What a defensible onboarding record contains

For each customer, an institution should be able to show:

• The identity evidence collected, and how it was verified.
• The liveness or presence check that tied the person to the document.
• Screening results, and how any matches were resolved.
• The risk rating, and the reason for it.
• The reviewer, the decision and the date.

Where Sentinel fits

Sentinel runs KYC, KYB and AML screening in one workflow and keeps the evidence and the reviewer's decision together for every customer, so the record exists when a supervisor, auditor or partner asks for it.