Platform

What is KYC and customer due diligence software?

Know-your-customer (KYC) and customer due diligence (CDD) software manages how an institution identifies a customer, verifies that identity, understands who ultimately owns or controls a business customer, assesses the customer's risk, and reviews that assessment over time. Higher-risk customers, including politically exposed persons, go through enhanced due diligence (EDD) with more evidence and senior approval. The software keeps the documents, decisions and review dates together so the file is complete when a regulator asks for it.

ERMAML, the Ontech Risk & Compliance Suite, provides onboarding workflows, CDD and EDD, beneficial ownership capture, a versioned document vault, risk-tier scoring with periodic review, and identity verification against the NRC, PACRA and ZRA registries, developed by Ontech Solutions in Lusaka for institutions in Zambia.

Request a Demo See the product tour

Key capabilities

Onboarding workflow

Structured capture of identity, address and business details with the checks required for the customer type, and a screening step before the record is accepted.

Registry verification

NRC numbers checked against the national registry, companies checked against PACRA for registration status and sector, and taxpayer numbers checked against the ZRA registry, with an identity-misuse flag when an NRC belongs to someone else.

Beneficial ownership

Ultimate beneficial owners captured through an ownership walk-through with thresholds, and each owner screened and verified.

Enhanced due diligence

An EDD workflow with its own form, evidence requirements and reviewer, triggered by PEP status, risk tier or adverse findings.

Document vault

Versioned identity, address and business documents with expiry tracking and renewal alerts.

Risk tiering and periodic review

Customers scored into risk tiers, re-scored when behaviour or screening results change, and reviewed on a cadence set by tier.

Data protection controls

Column-level encryption on personal data and a right-to-erasure workflow aligned to the Data Protection Act No. 3 of 2021.

How it works

The customer type determines which identity, address and ownership information must be collected.
Identity documents are verified against the NRC registry for individuals and PACRA and ZRA for companies.
The customer and any beneficial owners are screened against sanctions, PEP and adverse-media sources.
A risk tier is assigned from the customer's profile, and high-risk or PEP customers are routed to EDD.
Documents are stored in the vault with expiry dates, and the record is approved under maker-checker control.
Periodic reviews and event-driven re-scoring keep the file current, with erasure handled through a recorded workflow.

Benefits

Verified, not assumed

Registry checks replace face-value acceptance of photocopied IDs and company certificates.

Complete files

Documents, screening results, ownership and approvals sit on one record, so nothing is missing at review or inspection.

Reviews that happen on time

Tier-based cadences and expiry alerts stop reviews and document renewals from being forgotten.

Personal data handled lawfully

Encryption and a recorded erasure workflow support the institution's obligations under the Data Protection Act.

Who it is for

Onboarding and KYC teams at banks, MFIs and insurers.
Compliance officers responsible for EDD on PEPs and high-risk customers.
Telecoms and mobile-money operators keeping subscriber KYC current.
Pension funds verifying members and beneficiaries before payout.

Zambia-specific considerations

Customer due diligence in Zambia depends on national identifiers: the NRC for individuals, PACRA registration for companies and the ZRA taxpayer identification number for businesses. Verifying these against the issuing registries is the most reliable way to confirm that a customer exists and is who they say they are, and it is a check that manual KYC rarely performs.

The Data Protection Act No. 3 of 2021 governs how KYC data is stored and for how long, with the Office of the Data Protection Commissioner as regulator. KYC software used in Zambia therefore needs encryption, retention controls and a way to act on erasure requests, not just document storage.

How ERMAML addresses this

Registry checks in the onboarding flow

ERMAML verifies NRC, PACRA and ZRA details as part of onboarding and again at screening, caches conclusive results for a set period, and monitors taxpayer status so a deregistration raises an alert.

Screening and due diligence on one record

The KYC file, screening history, risk tier and EDD evidence are the same record the case management and reporting modules use.

Built for the Data Protection Act

PII column encryption, retention policy and a right-to-erasure workflow with an audit chain are part of the customer module.

Frequently asked questions

What is the difference between KYC, CDD and EDD?

KYC is the overall obligation to know who a customer is. Customer due diligence (CDD) is the standard set of steps: identifying and verifying the customer, understanding the purpose of the relationship and assessing risk. Enhanced due diligence (EDD) is the deeper set of checks applied to higher-risk customers such as politically exposed persons, with more evidence and senior approval.

How does ERMAML verify an NRC?

The NRC number and name are checked against the national registry at onboarding and at screening time. A conclusive result is cached for a set period so the check is not repeated unnecessarily, and an NRC that belongs to a different person raises an identity-misuse flag that forces four-eyes manual review.

Can it verify companies as well as individuals?

Yes. Company customers are checked against PACRA for registration status and sector, and against the ZRA taxpayer registry for the TPIN. Multiple active tax registrations under one name are flagged, and taxpayer status is monitored so deregistration raises an alert.

How is beneficial ownership captured?

An ownership walk-through records each owner and their percentage down to the natural persons who ultimately own or control the customer, applying the institution's thresholds. Each beneficial owner is then screened and verified like a direct customer.

How often are customers reviewed?

Review cadence is set by risk tier, and a customer is also re-scored when behaviour, screening results or registry status change. Document expiry dates trigger renewal alerts independently of the review cycle.

How does it handle a right-to-erasure request?

Erasure requests run through a recorded workflow that applies the institution's retention policy, so data that must be kept for AML record-keeping is distinguished from data that can be erased, and the decision is on the audit chain.

Sources

See ERMAML on your own data

Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.