Built for Zambia

AML/CFT compliance in Zambia: what reporting entities must do

AML/CFT compliance in Zambia means meeting the obligations placed on reporting entities by the Prohibition and Prevention of Money Laundering Act No. 14 of 2001 (as amended), the Financial Intelligence Centre Act No. 46 of 2010 (as amended) and the Anti-Terrorism and Non-Proliferation Act No. 6 of 2018. In practice that means knowing your customers, screening them against sanctions and politically exposed person lists, monitoring transactions for suspicious activity, keeping records, and reporting suspicious and cash transactions to the Financial Intelligence Centre (FIC) through goAML.

ERMAML, the Ontech Risk & Compliance Suite, is AML/CFT compliance software developed by Ontech Solutions in Lusaka for banks, microfinance institutions, insurers, pension funds, telecoms, money transfer operators and public bodies in Zambia. It puts KYC, screening, transaction monitoring, case management and goAML report drafting in one platform, alongside an enterprise risk register.

Request a Demo See the product tour

Key capabilities

Customer due diligence

KYC onboarding workflows with risk-tier scoring, enhanced due diligence for higher-risk customers, and periodic review cadences by tier.

Sanctions and PEP screening

Screening against UN, OFAC, EU, UK and OpenSanctions lists and the FIC PEP list, with fuzzy matching and a false-match review queue.

Registry-verified identity

NRC details checked against the national registry, and companies checked against PACRA and the ZRA taxpayer registry, at onboarding and at screening time.

Transaction monitoring

A rule engine covering structuring, velocity, threshold and geographic risk, plus an anomaly-detection model, with rules tunable from the interface.

Case management

Alerts become cases with maker-checker disposition, SLA-driven escalation and a tamper-evident audit trail on every decision.

goAML reporting

Suspicious transaction reports and cash transaction reports drafted in the goAML schema from case data, ready for submission to the FIC.

Training and attestation

Mandatory AML training assigned by role, with completion and attestation tracked for the compliance officer.

How it works

The institution's customer, transaction and policy data are connected to the platform through read-only integrations or file imports.
Customers are back-loaded, risk-tiered and screened against sanctions and PEP lists to establish a baseline.
New customers are verified against the national registries and screened before onboarding completes.
Transactions are monitored continuously against the tuned rules and the anomaly model, and alerts are raised for review.
Analysts investigate alerts as cases; a second reviewer approves each disposition under maker-checker control.
Reportable cases are drafted as goAML STRs or CTRs and submitted to the FIC through the institution's goAML account.

Benefits

One programme, one record

KYC, screening, monitoring and reporting share the same customer record, so the compliance officer can show the whole chain of evidence for any customer.

Fewer manual steps

Screening runs automatically on every customer and payment rather than one name at a time on a website.

Defensible decisions

Every alert disposition, whitelist entry and report is logged with who decided and when, which is what an inspector asks for.

Faster reporting

Reports are drafted from the case rather than retyped, reducing the mis-keyed names and missing fields that get filings rejected.

Who it is for

Money laundering reporting officers and compliance officers at banks, MFIs and insurers.
Money transfer operators, bureaux de change and payment providers screening every transfer.
Pension funds, telecoms and public bodies that pay out to members, subscribers or suppliers.
Internal audit and boards that want assurance the AML programme is operating as designed.

Zambia-specific considerations

Zambia's AML/CFT framework is built on three statutes: the Prohibition and Prevention of Money Laundering Act, which criminalises laundering and sets out the duties of reporting entities; the Financial Intelligence Centre Act, which established the FIC as the national financial intelligence unit that receives and analyses reports; and the Anti-Terrorism and Non-Proliferation Act, which covers terrorist financing and proliferation financing. Sector supervisors such as the Bank of Zambia, the Pensions and Insurance Authority and the Securities and Exchange Commission also examine AML controls as part of prudential supervision.

Zambia is a member of the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), the FATF-style regional body, so its regime is assessed against the FATF Recommendations. Reporting entities file suspicious transaction reports and cash transaction reports to the FIC through goAML, the UNODC reporting platform the FIC has adopted. Thresholds, timelines and report formats are set by the FIC and the relevant statutes, and institutions should confirm current requirements directly with the FIC.

How ERMAML addresses this

Built around the FIC's process

The case workflow ends in a goAML-schema STR or CTR with the taxpayer identification number populated from registry data, so the report matches what the FIC expects.

Identity checked at the source

NRC, PACRA and ZRA verification runs inside the KYC and screening steps, with duplicate-TPIN detection and an identity-misuse flag that forces manual review.

Hosted and governed in Zambia

Ontech hosts the platform at Infratel's Tier III facility in Lusaka and is a registered data controller (certificate DP000394), with PII column encryption and a right-to-erasure workflow.

Frequently asked questions

Which laws govern AML/CFT compliance in Zambia?

The Prohibition and Prevention of Money Laundering Act No. 14 of 2001 (as amended), the Financial Intelligence Centre Act No. 46 of 2010 (as amended) and the Anti-Terrorism and Non-Proliferation Act No. 6 of 2018. Sector regulators such as the Bank of Zambia and the Pensions and Insurance Authority also issue AML-related directives for the institutions they supervise.

Who receives suspicious transaction reports in Zambia?

The Financial Intelligence Centre (FIC), Zambia's financial intelligence unit. Reporting entities submit suspicious transaction reports and cash transaction reports to the FIC through goAML.

Which institutions are reporting entities?

The statutes define reporting entities broadly, covering banks and other financial institutions, insurers, pension administrators, securities firms, money transfer operators, and designated non-financial businesses and professions. Institutions should confirm their own status with the FIC or their sector regulator.

Does AML software make an institution compliant?

No. Compliance is the institution's obligation. Software makes the required steps systematic, evidenced and auditable: it screens every customer, monitors every transaction, records every decision and drafts reports in the right format. Policies, training and oversight remain the institution's responsibility.

Can ERMAML file reports to the FIC directly?

ERMAML drafts STRs and CTRs in the goAML schema from case data. Submission is made through the institution's own goAML account with the FIC, so the reporting officer keeps control of what is filed.

Is ERMAML suitable for a small institution?

Yes. Branch-scoped role-based access lets a single-branch MFI or bureau de change use the same platform as a multi-branch bank, and the AML and ERM modules share one login and one audit trail.

Sources

See ERMAML on your own data

Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.