Direct answers to common questions about AML/CFT software, enterprise risk management software, sanctions screening, goAML reporting and ERMAML.
AML/CFT compliance software
What is AML/CFT compliance software?
Software that runs the anti-money laundering and counter-terrorist financing controls a reporting entity must operate: customer due diligence, sanctions and politically exposed person screening, transaction monitoring, alert and case management, and the drafting of suspicious and cash transaction reports. It keeps every step and decision on one customer record with an audit trail. ERMAML, the Ontech Risk & Compliance Suite, is AML/CFT software built for institutions in Zambia.
What does sanctions screening software do?
It compares customer, counterparty and payment names against sanctions lists such as those of the United Nations, OFAC, the EU and the United Kingdom, plus politically exposed person and adverse-media sources. Matching allows for spelling variants and transliteration, and possible matches go to an analyst for review. ERMAML screens against these lists and the FIC PEP list, with a false-match review queue and a reusable whitelist.
Can software file STRs to the FIC?
Software can draft suspicious transaction reports in the goAML schema used by Zambia's Financial Intelligence Centre, populated from case data. Submission is made through the institution's own goAML account by the reporting officer. ERMAML drafts STRs and CTRs from the case record, applies maker-checker approval, and records the submission against the case.
How does transaction monitoring work?
Transactions are fed from the core system and evaluated against rules such as structuring below a threshold, unusual velocity, round-tripping, dormant-account reactivation and high-risk geography, and against an anomaly model that flags outliers. Matches raise alerts that analysts triage into cases. In ERMAML the rules are tunable from the interface and back-tested against historic data to calibrate false positives.
What is the difference between KYC and CDD?
Know your customer (KYC) is the overall process of identifying and understanding a customer. Customer due diligence (CDD) is the set of checks within it: verifying identity, understanding the purpose of the relationship and assessing risk. Enhanced due diligence (EDD) applies deeper checks to higher-risk customers such as politically exposed persons. ERMAML runs KYC onboarding with risk-tier scoring and EDD workflows.
Can ERMAML be used by a microfinance institution?
Yes. Branch-scoped role-based access lets a single-branch MFI or a multi-branch network use the same platform, and the AML and ERM modules share one login and one audit trail. Microfinance institutions are reporting entities under Zambian AML law and use the same KYC, screening, monitoring and goAML reporting functions as banks.
A system that records an institution's risks, the controls that mitigate them, the assessments that test those controls, and the indicators and incidents that show whether risk is rising, in one register that the board, the risk function, internal audit and the regulator can read. It replaces spreadsheet risk registers. ERMAML's ERM module provides the risk register, RCSA, KRIs, incident and operational-loss registers and executive dashboards.
What is the difference between ERM and GRC software?
Enterprise risk management focuses on identifying, scoring and treating risks. Governance, risk and compliance (GRC) is a broader label that adds regulatory obligations, policies, control testing and audit management. ERMAML covers both: the ERM module holds the risk register and KRIs, and the compliance register maps obligations and frameworks to controls and evidence.
What is an RCSA?
A risk and control self-assessment is a structured exercise in which the people who own a process identify its risks, rate the controls that mitigate them and record evidence, usually on a fixed cycle. It gives the risk function and internal audit a first-line view of control effectiveness. ERMAML schedules RCSA cycles with evidence attachment and reviewer sign-off.
What is a KRI?
A key risk indicator is a measurable value that signals rising exposure to a particular risk, such as the number of overdue loans or the age of the oldest open compliance alert. Each KRI carries a threshold; breaching it should trigger a defined response. ERMAML monitors KRIs against thresholds and escalates breaches automatically to the accountable owner.
Does ERMAML follow ISO 31000 or COSO?
The risk register and scoring model are anchored to ISO 31000 and the COSO enterprise risk management framework, and the control library can be mapped to ISO 27001, NIST CSF and COSO. Institutions configure their own risk taxonomy, likelihood and impact scales and appetite statements within that structure.
The Financial Intelligence Centre (FIC), established under the Financial Intelligence Centre Act No. 46 of 2010, is the national financial intelligence unit that receives and analyses suspicious and cash transaction reports. Sector supervisors such as the Bank of Zambia, the Pensions and Insurance Authority and the Securities and Exchange Commission also examine AML controls at the institutions they license. Zambia is a member of ESAAMLG, the regional FATF-style body.
What is goAML?
goAML is a reporting and analysis platform developed by the United Nations Office on Drugs and Crime for financial intelligence units. Zambia's FIC uses it to receive suspicious transaction reports and cash transaction reports from reporting entities, either through web forms or as XML files that follow the goAML schema. ERMAML drafts reports in that schema from case data.
What is the FIC PEP list?
A list of politically exposed persons maintained by the Financial Intelligence Centre for use by reporting entities in Zambia. Politically exposed persons hold or have held prominent public functions and are treated as higher risk, so they and their close associates require enhanced due diligence. ERMAML ingests the FIC PEP list for screening and rescreening.
How are NRC and PACRA details verified?
Through a registry-verification integration that checks a National Registration Card number against the national registration record, checks a company's registration and status against the PACRA companies register, and cross-checks the ZRA taxpayer identification number against both. ERMAML runs these checks at onboarding and screening and stores the results as evidence on the customer record.
What does the Data Protection Act require of a compliance system?
The Data Protection Act No. 3 of 2021 requires personal data to be processed lawfully and for a stated purpose, secured appropriately, retained no longer than necessary, and made available for data subject rights such as access and erasure. A compliance system should therefore encrypt personal data, limit access by role, apply retention policy and evidence how requests were handled. ERMAML provides column-level PII encryption and a right-to-erasure workflow.
The hosted service runs at Infratel's Tier III data centre in Lusaka, so customer data stays in Zambia. Ontech Solutions is a registered data controller with the Office of the Data Protection Commissioner, certificate DP000394. The platform is containerised, with PostgreSQL, Redis, ClickHouse and Elasticsearch behind an authenticating gateway.
Can it run on our own infrastructure?
Yes. The platform is packaged as a set of containers and can be deployed on an institution's own servers or private cloud where policy requires it. Ontech Solutions scopes on-premises deployments case by case; request a demo to discuss hosting, sizing and support arrangements.
Does it integrate with core banking or policy systems?
Yes. Customer and transaction data are connected through read-only integrations with core banking, policy administration, mobile money and similar systems, or through file imports where an interface is not available. Ontech maintains integration guides for banking, insurance, microfinance, pensions, telecom, energy, government and money transfer systems.
Does it support Active Directory single sign-on?
Yes. The platform can authenticate users against Microsoft Active Directory and map directory groups to platform roles, so joiners, movers and leavers are handled in the directory. The Active Directory integration guide on this site describes the configuration.
How is access controlled?
Through role-based access control with dynamic role and permission grants, per-user overrides and branch scoping, so a branch manager sees only that branch's data. Authentication uses JWT tokens verified at the gateway, with rate-limited login. Maker-checker review is enforced on dispositions, whitelists and report approvals.
Is the audit trail tamper-evident?
Yes. Case events, screening results, policy changes and decisions are written to a hash-chained audit log, so any later alteration of an entry breaks the chain and can be detected. This lets an auditor or regulator verify that the record has not been changed after the fact.
ERMAML, the Ontech Risk & Compliance Suite, is developed by Ontech Solutions, a software company based in Lusaka, Zambia. Ontech builds and supports the platform locally, hosts it at Infratel's Tier III facility in Lusaka, and is a registered data controller under the Data Protection Act 2021.
Which industries use it?
The suite is built for regulated institutions in Zambia: banks, microfinance institutions, insurers, pension funds, telecoms and mobile money operators, money transfer businesses, energy companies and public bodies. Each industry page on this site describes the regulators and obligations the platform is configured for in that sector.
What is the difference between ERMAML and the Ontech LifeI ERP?
They are separate products from the same company. Ontech LifeI ERP, at life.ontech.co.zm, is a life-insurance administration ERP covering policies, claims, underwriting and premium collection. ERMAML is the risk and compliance suite: enterprise risk management, AML/CFT screening, KYC, transaction monitoring and regulatory reporting. An insurer can use both, with LifeI running the business and ERMAML running risk and compliance.
How do I request a demo?
Use the request-a-demo page on this site, email info@ontech.co.zm with "Demo request" in the subject, or call +260 211 448 275 during Lusaka office hours. Tell us your institution type and the regulators you report to, and Ontech will arrange a walkthrough using your sector's obligations as the example.
Is there a free trial?
There is no self-service sign-up. Demonstrations and pilots are arranged by Ontech Solutions with each institution, because the platform is configured to your regulators, data sources and roles before use. Request a demo and Ontech will discuss whether a scoped pilot on your own data is appropriate.
Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.