What is AML/CFT compliance in Zambia?

The legal framework

Three Acts carry most of the weight. The Prohibition and Prevention of Money Laundering Act criminalises laundering and sets out the duty to report. The Financial Intelligence Centre Act establishes the FIC, defines who counts as a reporting entity and gives the Centre its powers to receive, analyse and disseminate financial intelligence. The Anti-Terrorism and Non-Proliferation Act covers the financing of terrorism and proliferation, including the duty to freeze assets of designated persons.

Zambia is a member of the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), the regional body that applies the FATF Recommendations. Much of what a supervisor expects to see in an institution mirrors those Recommendations: a risk-based approach, customer due diligence, record keeping, suspicious transaction reporting and internal controls. For current guidance and directives, the FIC and the sector regulators publish their own material and should always be checked directly.

Who is a reporting entity

The FIC Act lists categories of business that must comply. In general terms they include banks and other financial institutions supervised by the Bank of Zambia, insurers and pension schemes supervised by the Pensions and Insurance Authority, capital-markets participants supervised by the Securities and Exchange Commission, money-transfer and bureau de change operators, and designated non-financial businesses and professions such as lawyers, accountants, real-estate agents and dealers in high-value goods.

If your institution appears in one of those categories it is a reporting entity and the obligations below apply. The exact list, and any amendments, are in the Act and on the FIC's website.

Customer due diligence

Customer due diligence (CDD) is the requirement to identify a customer, verify that identity against reliable documents or data, understand the purpose of the relationship, and identify any beneficial owner behind a company or trust. Higher-risk customers, including politically exposed persons, require enhanced due diligence. The KYC and CDD guide walks through each step.

In Zambia, verification increasingly means checking an individual's NRC and a company's PACRA registration and ZRA taxpayer record against the registry rather than accepting a photocopy at face value.

Record keeping

Institutions must keep identification records, account files and transaction records for the period the law prescribes, in a form that lets the FIC or a supervisor reconstruct a transaction. The safest reading is that every document used to verify a customer, every screening result and every decision on an alert should be retrievable years later, with a record of who made the decision.

Monitoring and screening

Ongoing monitoring has two halves. The first is sanctions and PEP screening: checking customers and counterparties against the UN Security Council Consolidated List and other designated-persons lists, at onboarding and again whenever the lists change. The second is transaction monitoring: watching account activity for patterns that do not fit the customer's profile, such as structuring below a threshold, rapid movement of funds or dormant accounts that suddenly wake up.

• Screen at onboarding, on every list update and before large or unusual payments.
• Set monitoring rules that reflect your customer base, then tune them against real alerts.
• Record the outcome of every alert, including the ones closed as false positives.

Reporting to the FIC

When monitoring surfaces something the institution cannot explain, it files a suspicious transaction report (STR) with the FIC. Cash and other threshold-based reports are filed as prescribed by the Centre. The FIC receives reports electronically through goAML, the UNODC reporting system. The STR and goAML guide covers the process from alert to submission.

Training and the compliance officer

Reporting entities must appoint a compliance officer, often called the money laundering reporting officer (MLRO), with enough seniority and independence to escalate concerns and to file reports without interference. Staff who deal with customers or transactions must be trained to recognise red flags and to know the internal escalation route. Supervisors ask for evidence of both: the appointment letter and the training register.

How ERMAML handles this

ERMAML, the Ontech Risk & Compliance Suite, maps each obligation above to a module: KYC and CDD with registry verification, sanctions and PEP screening, transaction monitoring with tunable rules, case management with maker-checker review, goAML-schema STR drafting, a training and attestation module, and a tamper-evident audit trail so the record-keeping obligation is met as a by-product of the work.