Built for Zambia

Verifying identities against Zambia's national registries

Registry verification means checking the identity details a customer presents against the authoritative record rather than accepting a photocopy. In Zambia the three registries that matter for know-your-customer work are the national registration record behind the National Registration Card (NRC), issued by the Department of National Registration, Passport and Citizenship; the companies register held by the Patents and Companies Registration Agency (PACRA); and the taxpayer register held by the Zambia Revenue Authority (ZRA), which issues the taxpayer identification number (TPIN).

ERMAML, the Ontech Risk & Compliance Suite, runs these checks inside onboarding and screening through a registry-verification integration. An individual's NRC is checked against the national registry, a company is checked against PACRA for registration status and sector, and the ZRA taxpayer registry is cross-checked against both, in one pass, with the result stored as evidence on the customer record.

Request a Demo See the product tour

ERMAML screening result showing identity and politically exposed person checks

Key capabilities

NRC verification

A live check of the NRC number and holder details against the national registry at onboarding and again when the customer is screened.

PACRA business verification

Company registration, status and sector classification pulled from the companies register for corporate customers and suppliers.

ZRA taxpayer cross-check

The TPIN is checked against the taxpayer registry and reconciled with the NRC or PACRA record and the screened name in a single pass.

Duplicate-TPIN detection

Multiple active tax registrations under one name are flagged for review.

TPIN monitoring

Known taxpayers are re-checked daily; a deregistration raises an alert into the ERM incident register.

Identity-misuse flag

An NRC that belongs to someone other than the applicant forces four-eyes manual review before onboarding can proceed.

Verification cache and spend control

Conclusive results are reused within a configurable period, and the cost of registry queries is visible per month.

How it works

The customer's NRC, company registration number or TPIN is captured during onboarding or entered on the screening form.
The platform queries the relevant registry and compares the returned record with the details presented.
Matches, mismatches and misuse indicators are written to the customer record as verification evidence.
A mismatch or misuse flag routes the case to a second reviewer under maker-checker control.
Verified identifiers, including the TPIN, are reused in screening, in customer risk scoring and in goAML report drafting.
Ongoing monitoring re-checks taxpayer status and raises an incident if a registration lapses.

Benefits

Identity established, not assumed

The customer record is anchored to the registry, which removes the weakest link in most KYC files: the unverified photocopy.

Better screening matches

Verified names and identifiers reduce false positives and make it harder for a sanctioned or politically exposed person to pass under a variant name.

Evidence for inspectors

Each verification result is stored with its date and source, so the file shows what was checked and when.

Cleaner regulatory reports

The TPIN and registered names carried into STRs and CTRs come from the registry rather than a form.

Who it is for

Onboarding and KYC teams at banks, MFIs, insurers and payment providers.
Compliance officers responsible for customer due diligence evidence.
Procurement and vendor-management teams verifying suppliers and agents.
Pension funds and public bodies verifying beneficiaries and payees before payment.

Zambia-specific considerations

The NRC is the primary identity document for Zambian citizens and the identifier most institutions record at onboarding. PACRA administers company registration under the Companies Act No. 10 of 2017, and the ZRA issues the TPIN used across tax and, increasingly, financial onboarding. Checking all three together lets an institution confirm that a person exists, that a company is registered and active, and that the taxpayer record agrees with both.

Registry access is provided through authorised integrations, and query costs and availability depend on the provider. ERMAML caches conclusive results for a configurable period and reports monthly spend, so an institution can budget for verification. Personal data returned by the registries is subject to the Data Protection Act No. 3 of 2021 and should be held only for as long as the customer relationship and record-keeping obligations require.

How ERMAML addresses this

Three registries in one check

NRC, PACRA and ZRA are queried and cross-checked in a single pass at onboarding and screening, with results stored as evidence on the customer record.

Misuse and duplicates caught early

An NRC belonging to someone else forces four-eyes review, and multiple active TPINs under one name are flagged before the relationship is approved.

Verified data reused downstream

The same verified identifiers feed screening, risk scoring and goAML STR and CTR drafts, so a report never carries an unverified name.

Frequently asked questions

What is NRC verification?

Checking a National Registration Card number and the holder's details against the national registration record, rather than relying on a copy of the card. ERMAML performs this check at onboarding and at screening time and stores the result as evidence.

What can PACRA verification tell an institution?

Whether a company is registered, its current status and its sector classification, taken from the companies register administered by the Patents and Companies Registration Agency. This confirms that a corporate customer or supplier exists as a legal entity before due diligence continues.

Why cross-check the ZRA taxpayer registry?

The TPIN links a person or company to its tax record. Reconciling it with the NRC or PACRA record and the screened name exposes inconsistencies such as a name that does not match its registration, and it provides the identifier the FIC expects on goAML reports.

What happens when an NRC does not match the applicant?

ERMAML raises an identity-misuse flag and forces four-eyes manual review. The relationship cannot proceed until a second reviewer records a decision, and the flag remains in the audit trail.

Is registry data stored?

Verification results are stored as evidence on the customer record, and conclusive results are cached for a configurable period so repeat queries are not charged. Personal data is held under the institution's data protection obligations, with PII column encryption and a right-to-erasure workflow available.

Does this replace sanctions and PEP screening?

No. Registry verification confirms who the customer is; screening checks that person or company against sanctions, PEP and adverse-media sources. ERMAML runs both, and verified identifiers improve the accuracy of screening matches.

Sources

See ERMAML on your own data

Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.