Who may see beneficial ownership information
The narrow grounds on which a Kenyan company, or the firm holding its files, may disclose beneficial ownership details, and how to protect them.
By Achekam · · 5 min read · For Accountants & audit firms in Kenya
The requests come from every direction. A client's bank wants a copy of the ownership register before renewing a facility. A county tender committee asks for the owners' details with a bid. A prospective investor's lawyer would like "just the names". A junior on the audit team wonders aloud who the real owner of a client is, because the shareholder list looks odd.
Each of those people may have a perfectly good reason. Kenyan law still allows beneficial ownership information to travel only along a few defined routes, and a company secretary or accountant who sends it down the wrong one exposes the client to an offence. This article sets out the routes, the people who may never see the register in public, and a protocol for firms that hold ownership files for clients.
The permitted purposes in regulation 13
The Companies (Beneficial Ownership Information) Regulations deal with disclosure in regulation 13. A company may disclose beneficial ownership information only:
- to communicate with the beneficial owner;
- to comply with the Regulations themselves;
- to comply with anti-money laundering or terrorism laws;
- to comply with a court order; or
- with the beneficial owner's written consent, to a procuring entity in public procurement, a PPP contracting authority or a financial institution.
The word "only" carries the rule. There is no general business-purpose exception and no allowance for disclosure because a request seemed reasonable.
The Business Registration Service puts it the same way in its guidance. The BRS guide says the information may be disclosed only to the Registrar or as regulation 13 prescribes. It also points out that the company's register of beneficial owners, which may be kept manually or electronically, is a different thing from Form BOF1, the copy lodged with the Registrar. Whichever form the information sits in, the same disclosure limits apply. The guide itself, BRS's guide on disclosure of beneficial ownership information, also covers who counts as a beneficial owner and how the register is lodged.
Consent for procurement, PPPs and banks
The last ground is the one most requests rely on, and it has two conditions that are easy to skip.
First, the recipient must be one of three kinds of body: a procuring entity in public procurement, a contracting authority for a public-private partnership, or a financial institution. A prospective investor, a landlord or a supplier doing its own checks is not on that list.
Second, the beneficial owner must have given written consent. A director's verbal approval, or the company's own wish to win the tender, is not the same thing.
In practice, the bank and the tender committee from the opening example can both be served, once each beneficial owner has signed a consent naming the recipient. The investor's lawyer cannot be, unless the information is being given to the owner directly or another ground applies.
What is never made public
Regulation 15 goes further than restricting disclosure. It says beneficial ownership information is not to be made public, with two exceptions: the Public Procurement Regulatory Authority may publish it for tender winners, and a government may do so where the matter is one of public interest.
That leaves no room for a company or its advisers to publish the information themselves, whether on a website, in an annual report or in a marketing document.
The offence for getting it wrong
Under regulation 12, improper disclosure is an offence punishable by a fine of up to twenty thousand shillings or six months' imprisonment.
The amount is small next to many corporate penalties. The reputational cost of a firm being the source of a leaked ownership register is not, and a client is unlikely to keep an adviser that exposed its owners.
Restricting access and sharing in Achekam
A firm that holds a client's ownership register on Achekam can use three features to keep the circle small and the record clear.
Restricting the client. Partners and administrators can restrict a client, or a single engagement, to named people, giving a reason. The account manager and the engagement's partner and manager can always open it. A restriction is lifted rather than deleted, and who did what and when is recorded. For a client with sensitive ownership, restrict the company-secretarial engagement to the people who actually need it.
Sharing one document. When a ground in regulation 13 applies and the register must go to the bank or the procuring entity, staff can share the vault document with a named person by an e-mailed link. The link can block downloading, require a code and be revoked, and every view and download is recorded. By default the link lasts seven days, and the recipient needs no account. That beats an e-mail attachment that can be forwarded anywhere and leaves no trace.
Keeping a trail. Record Governance keeps a log of changes to governed records, showing who did what, when and with what result, and the log can be filtered and checked for an unbroken chain. Viewing it needs the AUDIT_LOG_VIEW permission, and it covers records under record governance rather than every screen.
If something does go wrong, with ownership data reaching someone it should not, the data protection rules may also apply; see the processor's breach notice.
A firm protocol for ownership files
| Step | What to do |
|---|---|
| Receive a request | Log who asked, for what, and why |
| Identify the ground | Match it to regulation 13; if none fits, decline politely |
| Consent cases | Get written consent from each beneficial owner, naming the recipient |
| Send | Share by a code-protected, download-blocked link to the named person |
| Close | Revoke the link once the purpose is met and note the date |
| Review | Check each quarter who has access to restricted ownership files |
Two habits make the protocol stick. Keep the signed consents in the same folder as the register, so the ground for each disclosure sits next to the information disclosed. And brief staff that the register is not working-paper material: it is opened for a reason and closed again.
How the register itself is prepared and lodged is covered in identifying beneficial owners and filing BOF1, and what happens when an owner will not give their details is in when a beneficial owner will not respond.
Before the next request arrives
Draft a one-page consent form for beneficial owners and a short reply for requests that fall outside regulation 13. Having both ready turns an awkward conversation into a routine one.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
