Platform
What does AML/CFT compliance software do?
Anti-money laundering and counter-financing of terrorism (AML/CFT) compliance software is the system a reporting institution uses to meet its legal duties to know its customers, screen them against sanctions and politically exposed person lists, watch transactions for suspicious patterns, investigate alerts, and report suspicious activity to the national financial intelligence unit. It replaces manual list checks, spreadsheet reviews and Word-drafted reports with one auditable workflow from onboarding to filing.
ERMAML, the Ontech Risk & Compliance Suite, is AML/CFT compliance software developed by Ontech Solutions in Lusaka for banks, microfinance institutions, insurers, pension funds, telecoms, money-transfer operators and public bodies in Zambia. Its AML module covers sanctions and PEP screening, KYC and customer due diligence, identity verification against the NRC, PACRA and ZRA registries, transaction monitoring, case management and goAML-schema STR and CTR drafting for the Financial Intelligence Centre, alongside the ERM module in the same platform.
Key capabilities
Sanctions and PEP screening
Customers and counterparties screened against the UN Security Council Consolidated List, OFAC, EU and UK lists, OpenSanctions and the FIC PEP list, with fuzzy and transliteration matching and a false-match review queue.
KYC and due diligence
Onboarding, customer due diligence, enhanced due diligence and beneficial ownership capture, with a document vault and periodic review scheduled by risk tier.
Registry-verified identity
NRC numbers checked against the national registry and companies against PACRA and the ZRA taxpayer registry, at onboarding and again at screening time.
Transaction monitoring
Seven default rules covering structuring, rapid movement, velocity spikes, high-risk geography, round-tripping, dormant reactivation and threshold breaches, plus anomaly detection on ingested transactions.
Case management
Alerts flow into cases with triage, investigation, maker-checker disposition and SLA-driven escalation, with every note and decision on a tamper-evident audit trail.
goAML reporting
Suspicious transaction reports and currency transaction reports drafted in the goAML schema from case data, ready for submission to the FIC.
Customer risk scoring
A live risk score per customer that re-scores when behaviour, screening results or registry status change, feeding periodic review and EDD triggers.
How it works
- Customer records are loaded from the core system or captured at onboarding, and each identity is verified against the relevant national registry.
- Every customer and beneficial owner is screened against sanctions, PEP and adverse-media sources, and rescreened as the lists change.
- Transactions are ingested and evaluated against the monitoring rules and the anomaly model.
- Matches and rule hits become alerts, which analysts triage into cases with maker-checker review.
- Cases that meet the reporting threshold are drafted as STRs or CTRs in the goAML schema and submitted to the FIC.
- Screening results, decisions and filings are retained on the audit trail for inspection by the regulator or internal audit.
Benefits
One workflow from onboarding to filing
Screening, due diligence, monitoring, investigation and reporting share one customer record, so nothing is re-keyed between steps.
Fewer false matches to clear
Fuzzy matching with entity-type filters and a reusable whitelist means analysts clear a false match once rather than every time a list refreshes.
Reports that match the case file
STRs are drafted from the case data itself, which removes transcription errors and keeps the filing consistent with the evidence.
Inspection-ready records
Every screening result and disposition is logged with who did it and when, which is what a regulator or auditor asks to see.
Who it is for
- Money laundering reporting officers and compliance officers at banks, MFIs and insurers.
- Money-transfer and bureau-de-change operators that screen every transfer.
- Pension funds and public bodies screening payees before disbursement.
- Compliance teams replacing website lookups and spreadsheet reviews with a single system.
Zambia-specific considerations
Reporting entities in Zambia operate under the Prohibition and Prevention of Money Laundering Act No. 14 of 2001 (as amended), the Anti-Terrorism and Non-Proliferation Act No. 6 of 2018 and the Financial Intelligence Centre Act No. 46 of 2010 (as amended). The Financial Intelligence Centre receives suspicious transaction reports through the goAML platform, and sector supervisors such as the Bank of Zambia and the Pensions and Insurance Authority examine how institutions meet their AML/CFT obligations. Zambia is a member of ESAAMLG and follows the FATF Recommendations.
Identity verification in Zambia rests on the NRC for individuals and on PACRA registration and the ZRA taxpayer number for companies. Software that checks these registries directly, rather than accepting photocopies, closes the gap that most manual KYC processes leave open.
How ERMAML addresses this
Screening, KYC, monitoring and reporting in one system
ERMAML holds the customer record, screening history, transactions, cases and filings together, so the STR an analyst files is built from the same data the regulator will later inspect.
Zambian registries and the FIC PEP list built in
NRC, PACRA and ZRA checks, the FIC PEP list and goAML-schema drafting are part of the platform rather than separate integrations.
Financial-crime risk visible to the board
Sanctions matches, STRs and critical alerts can raise incidents in the ERM register, so AML exposure sits beside operational and compliance risk in the same executive view.
Frequently asked questions
What is AML/CFT compliance software?
It is software that helps a reporting institution meet its anti-money laundering and counter-financing of terrorism duties: knowing and verifying customers, screening them against sanctions and PEP lists, monitoring transactions for suspicious patterns, investigating alerts through cases, and reporting suspicious activity to the financial intelligence unit, with an audit trail of every step.
Who has to use AML software in Zambia?
Reporting entities under Zambia's AML/CFT laws, including banks, microfinance institutions, insurers, pension schemes, securities firms, money-transfer operators and other designated businesses, must have systems for customer due diligence, screening, monitoring and reporting to the Financial Intelligence Centre. Whether a specific institution is a reporting entity is set by the legislation and its supervisor.
Does ERMAML file reports with the FIC?
ERMAML drafts suspicious transaction reports and currency transaction reports in the goAML schema from case data. The reporting institution reviews and submits them to the Financial Intelligence Centre through its goAML account, so the compliance officer stays in control of what is filed.
Which sanctions lists does it screen against?
The UN Security Council Consolidated List, OFAC, EU and UK lists, and the broader OpenSanctions dataset, together with the FIC PEP list and GDELT adverse media. Lists are synchronised on a schedule and customers are rescreened as they change.
Can it work with our core banking or insurance system?
Yes. Customer and transaction data are ingested from the institution's core system through read-only connectors, and settled payments pass through a screening gate before release. Ontech Solutions scopes the connectors during implementation.
Is the data hosted in Zambia?
ERMAML can be hosted at Infratel's Tier III facility in Lusaka, where Ontech Solutions already hosts the platform, or on the institution's own infrastructure. Ontech Solutions is registered as a data controller with the Office of the Data Protection Commissioner (DP000394).
Sources
See ERMAML on your own data
Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.
Last updated 2026-09-13. Published by Ontech Solutions, Lusaka, Zambia.