Proceeds of Crime and Anti-Money Laundering Act

What the Act Covers

The Proceeds of Crime and Anti-Money Laundering Act is Kenya’s core legal structure for detecting, deterring, and disrupting money laundering and related financial crime. It ties legal obligations to customer due diligence, recordkeeping, reporting, and internal control expectations across regulated entities.

For practitioners, the important point is that the act is not just about suspicious activity reports. It also shapes how organisations identify counterparties, understand beneficial ownership, and maintain an auditable trail that can withstand regulatory review and law-enforcement scrutiny.

Why It Matters in Financial Security

The act matters because money laundering controls are a trust and exposure problem as much as a compliance problem. Weak onboarding, incomplete verification, or poor transaction monitoring can let illicit funds move through legitimate rails and can also leave an institution unable to explain its own risk decisions.

In practice, the law helps convert financial-crime prevention into operational discipline: who is the customer, who benefits, what activity is expected, what activity is unusual, and what evidence supports the institution’s decision to accept or reject the relationship.

Those questions are especially important where corporate structures, intermediaries, or high-volume payment flows can obscure the true source or destination of funds. The act’s value is that it makes those hidden relationships visible enough to govern.

Controls and Compliance Expectations

Most of the act’s practical force comes from control design. Institutions need customer due diligence, enhanced checks for higher-risk relationships, sanctioning and monitoring logic where required, documented escalation paths, and retention of records that support investigation and reporting.

These controls are only effective when they are consistent across onboarding, transaction review, and ongoing monitoring. If one stage is strong but another is informal, the overall control environment becomes easier to bypass and harder to defend.

A useful way to think about the act is through the lifecycle of risk: initial verification, ongoing review, exception handling, suspicious activity escalation, and preservation of evidence for later review. Coverage across that lifecycle is what turns policy into enforcement.

For a broader framework view of AML and KYC obligations, FATF Recommendations , AML and KYC Framework is the most useful external reference point because it defines the international baseline that many national regimes, including Kenya’s, align with.

How to Interpret the Act Operationally

Operationally, the act should be read as a governance requirement for risk-based decision-making. It does not ask every customer to be treated the same way; it expects institutions to match the level of scrutiny to the risk profile, the product, the channel, and the ownership structure involved.

That means controls should be evidence-driven, not merely procedural. If an organisation cannot explain why it approved a customer, what information it relied on, and how it detected anomalies later, the compliance program is likely too weak to support the law’s intent.

The strongest implementations also connect compliance work to monitoring and remediation. A suspicious pattern is only useful if it leads to review, escalation, documentation, and, when required, reporting to the relevant authority.

Risk and Threat Considerations

The main risk is that weak due diligence or monitoring allows illicit funds, shell entities, or disguised beneficial ownership to move through legitimate channels. That creates regulatory exposure, reputational damage, and the possibility that an institution becomes an unwitting participant in financial crime.

Failure mechanism: Gaps in onboarding, verification, transaction surveillance, or escalation let abnormal activity blend into ordinary business, especially when ownership structures are complex or records are incomplete.

Impact: The institution may miss suspicious activity, fail to file required reports, face enforcement action, and lose the ability to demonstrate that its controls were reasonable and effective.

Practitioner Guidance

Why practitioners should care: This act is best treated as an operating model requirement, not a paperwork exercise. The quality of customer risk scoring, beneficial ownership tracing, and suspicious-activity escalation directly affects whether controls can stand up in a real review.

What to watch for: Inconsistent onboarding checks, weak escalation discipline, and records that cannot explain why a relationship was approved are all signs that the program may satisfy process but not actual control intent.

Practitioner takeaway: The most defensible AML programs are the ones that can show their work, from customer acceptance through ongoing monitoring and final reporting.

Related resources from NHI Mgmt Group

• What do compliance teams get wrong about anti-money laundering and identity checks in high-volume trading environments?
• Why do Customer Identification Programs matter for fraud and anti-money laundering controls?
• How should organisations align anti-money laundering controls with cross-border supervisory coordination in the EU?
• Why does fragmented banking infrastructure make anti-money laundering controls less effective?