Enterprise risk, AML/CFTP sanctions screening with live identity verification against Zambia’s national registries, control assessments and regulatory reporting — wired together for the way Zambia’s regulators actually work.
100+ integrated modules. 15 regulators wired. 17 compliance frameworks. Built for teams that have to move quickly.
DP000394
Infratel Tier III hosting
FATF & BoZ AML/CFT aligned
On-prem AI-powered
ERMAML, the Ontech Risk & Compliance Suite, is enterprise risk management and AML/CFT compliance software developed by Ontech Solutions in Lusaka for regulated institutions in Zambia. One platform holds the risk register, RCSA and KRIs alongside sanctions and PEP screening, KYC and due diligence, transaction monitoring, case management and goAML STR/CTR reporting to the Financial Intelligence Centre.
Identities are verified against the NRC, PACRA and ZRA registries, obligations are mapped to Zambian regulators, and the hosted service runs in Infratel's Tier III data centre in Lusaka. It serves banks, microfinance, insurers, pensions, telecoms, money transfer, energy and government.
ERMAML automates each department’s compliance work while giving the board and the regulator a unified source of truth — regardless of your sector.
BoZ prudential returns, FIC AML filings, Basel III alignment, and continuous sanctions screening in one operational view.
Answer six quick questions to gauge your AML/CFT & compliance maturity. Takes 90 seconds.
Everything your compliance, risk and audit teams need — seamlessly integrated into one platform.
Onboarding workflows, risk-tier scoring, periodic re-screening.
UBO walk-through with thresholds and verification evidence.
7 default rules, ML scoring, suppression engine, alert lifecycle.
Alert → case → STR with maker-checker disposition.
Single view of customer risk, transactions, screening and cases.
Isolation-forest anomaly model on every txn at ingest.
Structuring, velocity and threshold rules tunable in the UI.
SoF tracking with evidence vault and dispositions.
From obligation to evidence to filing — one operating system for every framework you carry.
Every framework you carry, mapped to the controls that satisfy it — with the deadline you owe the regulator.
Auto-collected evidence stored, versioned and linked to the control test that consumes it. No more scavenger hunts before the audit.
Filed in the format each regulator actually wants — BoZ returns, FIC STR/CTR, PIA solvency, NAPSA contributions.
How fast your institution can be audit-ready on ERMAML. Pick a size to see realistic timelines.
Map your data — core banking, KYC vendor, ledger, mobile-money switch — and wire read-only connectors.
Run a one-off back-load to populate risk tiers and PEP/sanctions baseline.
Tune monitoring rules against historic data; calibrate false-positive rates.
Collect existing control evidence and policies into the vault.
Switch on real-time sanctions and adverse-media screening.
Train Compliance Officers, analysts and reviewers; sign off on SOPs.
Walk-through with regulator artefacts; submit first filings.
The arc every customer follows — from connecting data to closing the audit.
Connect your data sources, baseline risk and compliance posture, identify gaps.
Switch on monitoring, harden controls, train teams, file with regulators.
Tune rules from feedback, surface KRI breaches, automate the predictable.
The real cost of running AML/CFT on spreadsheets — and what changes when the platform does the work.
Compliance, risk and ICT leaders across the region run their day on Ontech — from board-level oversight to the daily filings that keep regulators satisfied.
Goodfellow Finance
IDC
REA
ZICTA
GeePay
MLSS
Akros Research
NATSAVE Bank
The platform that holds your compliance evidence has to clear the bar it sets for everyone else.
PostgreSQL on Infratel Tier III in Lusaka. PII column encryption. DPA-aligned retention & right-to-erasure.
Real RBAC with dynamic role/permission grants, per-user overrides, JWT auth and rate-limited login at the edge.
Hash-chained audit log over case events and screening logs — every decision, every policy change, every screening result.
If a sanctions sync stalls or a screening queue ages, you should know before the regulator does.
Freshness, last delta, indexed-record count.
Live p50 / p95 / p99 on the screening gate.
Live aging buckets; breach-predicted alerts highlighted.
Cluster health, shard status, ingest rate.
SLA-aware alerts that escalate as cases age past threshold.
Drill into AML, ERM and ICT-side KPIs from one place.
PgBouncer pooling + replica back-ends + ES multi-node config.
Customer-risk scoring, compliance Q&A, anomaly detection — trained on your data, in your data centre.
Embedding search across policies, regulations, cases and STR archives — find the precedent fast.
Q&A grounded in BoZ / FIC / PIA / ZICTA source documents. Cites the section, every time.
Calibrated GBT classifier on customer + transaction features with continuous learning.
IsolationForest at the ingest path catches outliers in seconds, not weeks.
Direct answers about ERMAML for compliance, risk and audit teams in Zambia.
ERMAML is enterprise risk management and AML/CFT compliance software developed by Ontech Solutions in Lusaka. One platform holds the risk register, RCSA and KRIs alongside sanctions and PEP screening, KYC, transaction monitoring, case management and goAML STR/CTR reporting, with identity verification against the NRC, PACRA and ZRA registries.
Regulated institutions in Zambia: banks, microfinance institutions, insurers, pension funds and administrators, telecoms and mobile-money operators, money-transfer businesses, energy companies and public bodies. Role-based access scoped by branch lets a single office or a multi-branch network use the same platform.
Screening runs against a locally synced watchlist built from the UN Security Council Consolidated List, OFAC, EU and UK lists and the OpenSanctions dataset, plus the FIC PEP list and adverse-media sources. Matching is fuzzy and transliteration-aware, and false matches go to a four-eyes review queue with a reusable whitelist.
Yes. Alerts become cases, cases are dispositioned under maker-checker review, and a suspicious or currency transaction report is drafted in the goAML schema from the case data, ready for submission through the FIC's goAML portal.
Yes. NRC details are checked against the national registry, companies against PACRA, and taxpayers against the ZRA registry, at onboarding and at screening time, with duplicate-TPIN detection and an identity-misuse flag that forces manual review.
The hosted service runs in Infratel's Tier III data centre in Lusaka, so customer data stays in Zambia. Ontech Solutions is a registered data controller (certificate DP000394). On-premises deployment on an institution's own infrastructure is also available.
Use the Request a Demo button or the contact page to reach Ontech Solutions. A demo walks through screening, KYC, transaction monitoring, case management, goAML reporting and the risk register using your industry's obligations as the example.