Industry

Compliance software for telecoms and mobile-money operators in Zambia

A telecoms operator in Zambia is licensed by ZICTA under the ICT Act No. 15 of 2009 and submits quality-of-service and traffic returns; if it also runs a mobile-money service it falls under Bank of Zambia payment-system oversight and the anti-money laundering framework, with customer due diligence on subscribers and wallet holders and reporting to the Financial Intelligence Centre. Its networks are likely to be designated critical information infrastructure under the Cyber Security Act 2025, and subscriber data is governed by the Data Protection Act No. 3 of 2021.

ERMAML, the Ontech Risk & Compliance Suite, tracks those obligations in one place: ZICTA return layouts and submission tracking, continuous subscriber and wallet KYC with PEP rescreening, a critical-infrastructure control register with periodic attestation, an operational-loss register that links outages to control failures, anomaly detection on subscriber and money-flow patterns to surface SIM-swap fraud, and a right-to-erasure workflow for data-subject requests.

Request a Demo See the product tour

Key capabilities

ZICTA returns

Quality-of-service and traffic return layouts prepared from operational data with submission tracking against the filing calendar.

Subscriber and wallet KYC

Continuous monitoring of subscriber due diligence as numbers change hands, with scheduled PEP rescreening of wallet holders.

Critical infrastructure controls

Cyber Security Act obligations for critical information infrastructure kept as a control register with quarterly attestation.

Network and operational risk

Outages and incidents recorded in an operational-loss register and linked to the controls that failed, so cause analysis reaches the board.

Fraud detection

Anomaly detection over subscriber and money-flow patterns to surface SIM-swap and account-takeover fraud early.

Data protection workflow

Right-to-erasure and breach-response workflows with an audit chain, and column-level encryption of subscriber PII.

Transaction monitoring for mobile money

Seven default rules for structuring, velocity and thresholds applied to wallet transactions, tunable from the interface.

How it works

Subscriber, wallet and network operational data are connected through read-only feeds.
The subscriber and wallet book is back-loaded, risk-tiered and screened against sanctions and PEP lists.
Monitoring rules and anomaly models run over wallet transactions and subscriber events.
Alerts become cases under maker-checker review, with STRs drafted in goAML format where warranted.
Critical-infrastructure controls are attested each quarter and incidents are linked to them.
ZICTA returns and board reports are produced from the same records.

Benefits

One register for two regulators

ZICTA obligations and payment-system and AML obligations sit in one compliance register with one calendar.

KYC that follows the subscriber

Continuous monitoring catches changes of ownership and PEP status that a one-time registration check would miss.

Fraud surfaced before losses accumulate

Anomaly detection on subscriber and money-flow patterns gives fraud teams early signals.

Cyber obligations evidenced

Quarterly attestation on the critical-infrastructure control register produces the evidence the Act expects.

Who it is for

Mobile network operators and internet service providers licensed by ZICTA.
Mobile-money and payment service providers overseen by the Bank of Zambia.
Fraud, risk and cyber security teams inside operators.
Data protection officers handling subscriber data requests.

Zambia-specific considerations

ZICTA licenses and regulates ICT operators under the ICT Act No. 15 of 2009, while mobile money is regulated by the Bank of Zambia as a payment system. An operator that offers both therefore reports to two regulators with different return formats, and ERMAML keeps both sets of obligations in one register.

The Cyber Security Act 2025 introduces obligations for operators of critical information infrastructure, and the Data Protection Act No. 3 of 2021 governs subscriber data. ERMAML's control register, attestation cycle and erasure workflow are designed to produce the evidence those laws call for.

How ERMAML addresses this

Subscriber KYC monitored continuously

Due diligence is re-evaluated as numbers change hands and wallet behaviour changes, with PEP rescreening on a schedule.

Critical-infrastructure controls with attestation

Obligations under the Cyber Security Act are held as controls with owners and quarterly attestation, linked to incidents when they occur.

Money-flow anomaly detection

The same monitoring engine used for banks runs over wallet transactions and subscriber events to flag SIM-swap and structuring patterns.

Frequently asked questions

Which regulators does a mobile-money operator in Zambia answer to?

ZICTA licenses the telecoms operation under the ICT Act, the Bank of Zambia oversees mobile money as a payment system, and the Financial Intelligence Centre receives suspicious transaction reports under the anti-money laundering laws. The Data Protection Act and the Cyber Security Act apply to subscriber data and network infrastructure.

Can ERMAML prepare ZICTA returns?

Return layouts for quality-of-service and traffic reporting are prepared from operational data and tracked against the filing calendar. The operator reviews and submits them; the platform records what was filed and when.

How does it handle subscriber KYC?

Subscriber and wallet-holder due diligence is monitored continuously, so a change of ownership or a change in PEP status triggers review. Identity can be verified against the NRC registry, and documents are kept in a versioned vault.

Does it detect SIM-swap fraud?

Anomaly detection runs over subscriber events and money-flow patterns and raises alerts on unusual combinations, such as a SIM change followed by rapid wallet activity. Alerts are worked as cases by the fraud team.

How are Cyber Security Act obligations tracked?

Obligations for critical information infrastructure are entered as controls with owners and evidence, attested quarterly, and linked to incidents in the operational-loss register when a control fails.

Sources

See ERMAML on your own data

Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.