Kenya raises terror-financing fines to Sh20 million as institutions face tougher reporting rules

Kenya has raised the maximum fine for legal entities that breach its terror-financing rules from Sh3 million to Sh20 million, as the country strengthens its financial-crime controls and works to address concerns linked to its continued placement under increased monitoring by the Financial Action Task Force (FATF).

The revised regulations, gazetted on September 7, 2026, replace the 2023 rules and introduce tougher penalties alongside more detailed reporting obligations for institutions handling financial transactions. The maximum fine for an individual has been reduced from Sh3 million to Sh1 million, while the maximum prison term has increased from seven to 10 years.

The new framework applies to a wider group of reporting institutions, including financial institutions, designated non-financial businesses and professions, and virtual asset service providers. Its practical effect will depend on how quickly these institutions can identify sanctioned individuals and entities, freeze linked assets, trace related accounts and submit accurate information to regulators.

Kenya raises maximum corporate penalty for terror-financing breaches

Under the revised regulations, where a specific penalty is not provided, a natural person convicted of an offence may face imprisonment for up to 10 years. A legal person may be fined up to Sh20 million, while an individual may face a fine of up to Sh1 million.

The Sh20 million figure is a maximum penalty imposed upon conviction. It should not be interpreted as an automatic charge applied to every institution that makes a compliance mistake.

The change nevertheless represents a substantial increase in the potential financial exposure of companies. The previous regulations capped the maximum fine for a legal person at Sh3 million, meaning the new ceiling is more than six times higher. For individuals, the maximum fine has moved in the opposite direction, falling to Sh1 million.

The revised rules come as Kenya continues to respond to FATF concerns. The country was placed under increased monitoring, commonly referred to as the grey list, in February 2024 and remained on the list following the organisation’s June 2026 review.

FATF has called for stronger risk-based supervision of financial institutions and designated non-financial businesses and professions, improved preventive measures and suspicious transaction reporting, more effective investigations and prosecutions, better use of financial intelligence, and stronger transparency around trusts and beneficial ownership.

New rules impose faster reporting and sanctions-monitoring duties

The regulations retain the requirement for institutions to freeze funds linked to designated terrorists or terrorist entities without prior notice. However, they provide more detail on the speed and information required when such action is taken.

The 2023 regulations defined “without delay” as within 24 hours. The revised framework refers to action being taken “within a matter of hours” while retaining a 24-hour reporting deadline. The Financial Reporting Centre has previously indicated that implementation should be almost immediate, with the 24-hour period beginning when the relevant person or entity is listed by the United Nations Security Council.

Institutions must report the action taken against sanctioned accounts to the Counter Financing of Terrorism Inter-Ministerial Committee within 24 hours. The report must include the account number, account holder, exact time the freeze took effect, balance at the time of the freeze, details of related accounts and the reasons those accounts have been identified as related.

The reporting requirement also covers attempted transactions made after an asset freeze. Institutions must provide details of the account involved, the time of the attempted transaction, the balance and information about the person who attempted to transact.

These provisions place greater emphasis on the connections between accounts and financial activity. A sanctioned person or entity may have funds distributed across several accounts, institutions or payment channels, making a single-account freeze insufficient to establish the full extent of the financial relationship.

The rules also require institutions to conduct regular reviews of domestic and United Nations sanctions lists and continuously monitor transactions involving listed individuals and entities. That creates a need for accurate customer records, timely list updates, effective transaction monitoring and clear escalation procedures when a potential match is identified.

Compliance obligations extend beyond commercial banks

Although banks are likely to face much of the operational burden, the regulations apply to a broader financial ecosystem. The definition of a reporting institution includes financial institutions, designated non-financial businesses and professions, and virtual asset service providers.

That broader scope reflects the way money can move through several channels before reaching its final destination. A transaction may involve a commercial bank, a remittance provider, a mobile-money service, a digital lender, a payment intermediary or a virtual-asset platform. Effective monitoring therefore requires institutions to identify relationships that may not be visible from an individual transaction viewed in isolation.

A recent investigation by the Assets Recovery Agency illustrates the complexity of tracing financial activity across these channels. The case involved alleged flows through shell companies, intermediary bank accounts, remittance platforms, M-Pesa transactions and Binance wallets holding USDT. The agency obtained preservation orders covering about Sh115 million, while investigators estimated that property traceable to the respondents exceeded Sh300 million. The allegations remain subject to court determination.

The case does not arise from the new terror-financing regulations, but it demonstrates why financial-crime investigations can require information from multiple institutions and payment systems. The revised rules’ requirements around related accounts and attempted transactions are relevant to that wider challenge because they seek to ensure that institutions report more than the existence of a single frozen account.

The compliance burden may also be uneven. A large bank may already operate sanctions-screening and transaction-monitoring systems, while a smaller provider may rely on manual checks, fragmented records or periodic reviews. A Central Bank of Kenya survey of digital lenders previously identified gaps in sanctions awareness, enhanced due diligence, sanctions-list maintenance and screening procedures.

That survey reported that 71 percent of respondents screened customers against global sanctions lists, while less than half said they kept those lists up to date. It also found that only 35 percent conducted enhanced due diligence. The findings provide useful background on the sector’s preparedness, although they should not be treated as a current measurement of every digital lender’s compliance position.

Kenya’s financial-crime reforms face an institutional capacity test

The revised regulations increase the amount of information that reporting institutions must collect and submit, but the value of that information depends on the capacity of public agencies to analyse and act on it.

The Financial Reporting Centre has faced questions about funding and operational capacity as Kenya works to address FATF requirements. In May 2026, parliamentary discussions included a proposed additional allocation of Sh388.16 million for the centre, while the agency had identified a minimum workable funding requirement of Sh1.33 billion. The FRC also reported that it receives thousands of suspicious transaction and suspicious activity reports annually.

More detailed reporting, faster asset-freezing timelines and broader institutional coverage could improve the quality of financial intelligence, but they also increase the need for trained personnel, reliable databases, secure information-sharing systems and coordination between regulators, investigators and prosecutors.

The technology implications are significant. Institutions will need to maintain current sanctions lists, screen customers and transactions, identify possible links between accounts, preserve audit trails and distinguish genuine matches from false positives. These functions can involve automated tools, but the regulations themselves do not mandate a particular technology such as artificial intelligence, blockchain analytics or a specific sanctions-screening platform.

Accuracy is especially important where a sanctions match can lead to an account being frozen. The revised framework includes a mechanism for people wrongly included on a terrorism-linked list to apply to the Counter Financing of Terrorism Inter-Ministerial Committee for repeal. The committee is required to determine the application and communicate its decision to holders of the frozen assets.

That provision recognises the risk of mistaken identification, although the practical protection it offers will depend on how accessible the process is, how quickly applications are resolved and how clearly institutions communicate with affected customers.

Kenya is also addressing related information gaps through reforms concerning beneficial ownership and trusts. New trust-administration provisions seek to establish greater transparency around the people who create, manage and ultimately benefit from trusts, aligning with FATF concerns about ownership and control of legal arrangements.

Taken together, these measures form part of a broader compliance framework. Beneficial-ownership rules can help establish who is behind an asset or structure; sanctions and monitoring rules govern how institutions respond to designated or suspicious activity; and financial-intelligence agencies must then have the capacity to process the information and support investigations.

The revised terror-financing regulations therefore raise the consequences of non-compliance while demanding faster and more connected monitoring across Kenya’s financial system. Their impact will be measured not only by the size of the penalties imposed, but also by whether institutions can meet the reporting requirements and whether regulators can turn those reports into effective financial intelligence and enforcement.

Real ESG impact doesn’t happen in panels alone, it happens in the rooms where financiers, operators, and policymakers actually align. Our GreenShift Forum 2026 cuts the noise, bringing together the people rewiring  Africa’s sustainability and energy frameworks for one focused day in Nairobi. Secure your seat.

Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.

Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to info@techtrendsmedia.co.ke