Built for Zambia

Which regulators Zambian institutions report to, and how a compliance register keeps up

A regulated institution in Zambia usually reports to several regulators at once: a sector supervisor such as the Bank of Zambia or the Pensions and Insurance Authority, the Financial Intelligence Centre for AML reporting, the Zambia Revenue Authority for tax, and cross-cutting bodies such as the Office of the Data Protection Commissioner. Each expects periodic returns, filings or attestations in its own format and on its own calendar, and each may inspect the evidence behind them.

A compliance register records every obligation, who owns it, the controls and evidence that satisfy it, and when it falls due. ERMAML, the Ontech Risk & Compliance Suite, provides that register with a filing calendar, SLA alerts and evidence linkage, and prepares data for returns from the live risk, customer and transaction records.

Request a Demo See the product tour

Key capabilities

Obligations register

Each regulatory requirement is recorded with its source, owner, frequency and the controls and evidence that satisfy it.

Filing calendar

Returns and attestations are scheduled with reminders, escalation and SLA breach alerts so nothing is discovered late.

Return preparation

Data for prudential, AML and sector returns is drawn from the live registers rather than rebuilt in spreadsheets each period.

Framework mapping

Controls are mapped to frameworks such as the FATF Recommendations, ISO 31000, ISO 27001, NIST CSF and COSO, and to Zambian obligations.

Evidence vault

Policies, certificates, submissions and correspondence are versioned and linked to the obligation they support.

Inspection readiness

An audit pack for any regulator can be exported from the register, showing obligations, controls, evidence and filing history.

Branch and entity scoping

Multi-branch and group structures roll up to a consolidated view while keeping branch-level accountability.

How it works

The institution loads the obligations that apply to it, by regulator and by law, into the register.
Each obligation is assigned an owner, a frequency and the controls and evidence that satisfy it.
The filing calendar schedules returns and attestations and alerts owners as due dates approach.
Return data is prepared from the live registers and reviewed under maker-checker control before submission.
Submissions and regulator correspondence are stored as evidence against the obligation.
The board and internal audit review compliance status from the same register the owners maintain.

Benefits

No missed filings

Every return has an owner, a date and an escalation path.

One source for every regulator

Prudential, AML, tax, data protection and sector obligations are managed in one register rather than in separate trackers.

Faster inspections

Evidence is already linked to the obligation, so an inspection request is answered from the register.

Board visibility

Compliance status is reported live rather than assembled for the quarterly meeting.

Who it is for

Compliance officers coordinating returns to several regulators.
Finance teams preparing prudential and statutory returns.
Company secretaries and legal teams tracking licence conditions and attestations.
Group and multi-branch institutions consolidating compliance across entities.

Zambia-specific considerations

The regulators most Zambian institutions deal with are: the Bank of Zambia (BoZ), which supervises banks and financial institutions under the Banking and Financial Services Act No. 7 of 2017 and oversees payment systems; the Financial Intelligence Centre (FIC), the national financial intelligence unit that receives STRs and CTRs; the Pensions and Insurance Authority (PIA), which regulates insurers under the Insurance Act No. 38 of 2021 and pension schemes under the Pension Scheme Regulation Act; the Securities and Exchange Commission (SEC), which regulates capital markets under the Securities Act No. 41 of 2016; the Zambia Information and Communications Technology Authority (ZICTA), which regulates ICT and telecoms under the ICT Act No. 15 of 2009; the National Pension Scheme Authority (NAPSA), which administers the statutory pension scheme; the National Health Insurance Management Authority (NHIMA), which administers national health insurance; the Energy Regulation Board (ERB), which licenses and regulates the energy sector; the Zambia Environmental Management Agency (ZEMA), which regulates environmental compliance; the Zambia Public Procurement Authority (ZPPA), which regulates public procurement; the Anti-Corruption Commission (ACC), which enforces the Anti-Corruption Act; the Patents and Companies Registration Agency (PACRA), which administers company registration under the Companies Act No. 10 of 2017; the Zambia Revenue Authority (ZRA), which administers tax and issues the TPIN; the Competition and Consumer Protection Commission (CCPC), which regulates competition and consumer protection; and the Workers' Compensation Fund Control Board (WCFCB), which administers workers' compensation.

Which of these apply, and what each expects, depends on the institution's licence and sector. Return formats, frequencies and deadlines are set by each regulator and change over time, so the register should be maintained against the regulator's current instructions rather than treated as fixed. Cross-cutting laws, including the Data Protection Act No. 3 of 2021 and the Cyber Security Act 2025, add obligations that apply regardless of sector.

How ERMAML addresses this

A register built for Zambian obligations

The compliance register ships with obligations and frameworks relevant to the regulators listed here, a filing calendar and evidence linkage, and is maintained against each regulator's current instructions.

Returns from live data

Prudential, AML and sector return data is drawn from the risk, customer and transaction registers, with maker-checker review before submission.

Same platform as risk and AML

Obligations, controls, incidents and screening events share one audit trail, so the compliance status the board sees reflects what the operational teams do.

Frequently asked questions

Which regulators does a Zambian bank report to?

Typically the Bank of Zambia for prudential supervision and payment systems, the Financial Intelligence Centre for AML reporting, the Zambia Revenue Authority for tax, and the Office of the Data Protection Commissioner for data protection, plus PACRA for company filings. Banks with insurance or securities arms also report to the PIA or SEC.

Which regulators does an insurer or pension fund report to?

The Pensions and Insurance Authority regulates insurers and pension schemes. Pension administrators also interact with NAPSA on statutory contributions. Insurers and pension funds are reporting entities for AML purposes and file to the FIC, and all report to the ZRA and PACRA.

What is a compliance register?

A structured record of every regulatory obligation an institution has, with its source, owner, frequency, the controls and evidence that satisfy it, and its filing history. It replaces separate spreadsheets kept by different departments with one register the board and auditors can read.

Does ERMAML submit returns to regulators?

ERMAML prepares return data from the live registers, schedules filings and stores submissions as evidence. Submission itself is made through each regulator's own channel by the responsible officer, and the register records that it was done.

How are changes in regulatory requirements handled?

Obligations in the register are edited by the institution as regulators issue new instructions. Each change is logged, and the owner, controls and calendar entries update with it. The register should be reviewed against each regulator's current guidance rather than relied on as a fixed list.

Can one register cover a group with several licensed entities?

Yes. Branch and entity scoping keeps each entity's obligations and evidence separate while rolling up to a consolidated group view for the board and internal audit.

Sources

See ERMAML on your own data

Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.