Industry

AML and risk management software for microfinance institutions in Zambia

Microfinance institutions in Zambia are licensed and supervised by the Bank of Zambia as non-bank financial institutions under the Banking and Financial Services Act No. 7 of 2017, and they are reporting entities under the anti-money laundering laws administered by the Financial Intelligence Centre. An MFI must identify and verify its customers, keep due diligence records, monitor lending and repayment activity for suspicious patterns, report to the FIC, and submit periodic returns to the Bank of Zambia, usually consolidated from several branches. Its board also expects a view of credit concentration, operational losses and staff compliance.

ERMAML, the Ontech Risk & Compliance Suite, is built so that the same platform works for a single-branch MFI and for a multi-branch network. Branch-scoped role-based access keeps each branch to its own customers while head office sees the consolidated picture; the AML module covers KYC, rescreening and FIC reporting; and the ERM module tracks loan-book risk, key risk indicators and mandatory training.

Request a Demo See the product tour

Key capabilities

Branch-to-corporate consolidation

Returns and risk views roll up from branch to head office, with each branch's data visible only to the roles entitled to see it.

KYC document vault

Customer due diligence documents are stored with versions and renewal alerts instead of in shared drives, and customers are rescreened against the PEP list on a schedule.

Event-driven customer risk

A customer's risk tier is re-scored when behaviour changes rather than set once at onboarding.

Loan-book risk dashboard

Concentration and portfolio limits are tracked as key risk indicators that alert when a threshold is breached.

Case management with FIC reporting

Alerts are worked as cases under maker-checker review with disposition codes, and suspicious transaction reports are drafted in the goAML format the FIC uses.

Training and attestation

A learning module assigns mandatory courses by role and records completion and attestation, replacing sign-in sheets.

Registry verification

NRC checks against the national registry and PACRA and ZRA checks on business borrowers run at onboarding.

How it works

Branches and roles are configured so that each branch manager sees only that branch's customers and cases.
Existing customers are back-loaded, risk-tiered and screened against sanctions and PEP lists.
Loan and repayment data feed the monitoring rules and the loan-book indicators.
Alerts and periodic KYC reviews are worked as cases in each branch and escalated to head office when required.
Head office consolidates branch data into Bank of Zambia returns and board reports.
Staff complete assigned compliance training and attest to policies inside the platform.

Benefits

Scales without re-platforming

The same configuration serves one branch or fifty; adding a branch is a role and scope change, not a new deployment.

Due diligence that stays current

Renewal alerts and scheduled rescreening keep KYC files and PEP status up to date between reviews.

Earlier sight of portfolio risk

Concentration and repayment indicators alert as thresholds are crossed instead of surfacing at month end.

Evidence for the supervisor

Training records, attestations and case histories are in one place when the Bank of Zambia or the FIC asks.

Who it is for

Deposit-taking and non-deposit-taking microfinance institutions supervised by the Bank of Zambia.
Compliance officers responsible for KYC files and FIC reporting across several branches.
Credit and risk managers who track concentration and repayment risk on the loan book.
Boards that want a consolidated risk and compliance view of a branch network.

Zambia-specific considerations

Microfinance in Zambia ranges from small institutions with a handful of branches to networks that span provinces. Consolidating returns and case work from branches is where most manual effort goes, and it is also where inconsistencies in customer due diligence creep in. Branch-scoped access with a single consolidated register addresses both.

As reporting entities under the Financial Intelligence Centre Act, MFIs must report suspicious transactions to the FIC. ERMAML drafts those reports in the goAML schema from case data, so a branch compliance officer's investigation becomes the reporting officer's submission without rekeying.

How ERMAML addresses this

One platform for a branch network

Role-based access is scoped by branch, and returns, KRIs and cases roll up to head office, so an MFI does not need one tool per branch or a separate consolidation spreadsheet.

KYC that is verified and maintained

The document vault, registry verification and scheduled PEP rescreening keep due diligence files complete and current between periodic reviews.

Loan-book and operational risk in the same register

Credit concentration, operational losses and compliance incidents are tracked as risks with indicators and owners, alongside the AML programme.

Frequently asked questions

Which regulator supervises microfinance institutions in Zambia?

The Bank of Zambia licenses and supervises microfinance institutions as non-bank financial institutions under the Banking and Financial Services Act No. 7 of 2017. MFIs are also reporting entities under the anti-money laundering laws administered by the Financial Intelligence Centre, which receives their suspicious transaction reports.

Can a small MFI use ERMAML, or is it built for banks?

The platform is used the same way by a single-branch institution and a multi-branch network. A small MFI configures one branch and a few roles; a larger one adds branches and scopes access to them. The AML, ERM and training modules are the same in both cases.

How does ERMAML help with KYC across branches?

Each customer's due diligence documents are stored in a versioned vault with renewal alerts, identity is verified against the NRC registry, and PEP rescreening runs on a schedule. Branch staff maintain their own customers, and head office can review the consolidated position.

Does it track loan-book risk?

Yes. Concentration limits and repayment behaviour are tracked as key risk indicators with thresholds, and breaches alert the owner. Losses are recorded in the operational-loss register with category-level analytics.

How is mandatory compliance training recorded?

The learning module assigns courses by role, records completion, and captures policy attestations, so the institution can show the supervisor who has been trained on what and when.

Sources

See ERMAML on your own data

Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.