Client due diligence records for Kenyan firms
The identity and ownership records a Kenyan firm should hold on each client, and the sanctions and PEP checks it must run outside Achekam.
By Achekam · · 6 min read · For Accountants & audit firms in Kenya
A new client signs the engagement letter, the first bank statements arrive, and the work starts. Months later a reviewer opens the file and asks a plain question: who owns this company, and how did the firm satisfy itself about them? If the answer is a remembered conversation, the file has a gap.
Client due diligence is not glamorous, and in a busy Kenyan practice it tends to be done in a hurry at the start of an engagement and never revisited. That is the wrong way round. The records are what the firm will be judged on, and since ICPAK took on a supervisory role for anti-money laundering, the question of what sits in each client file has become sharper.
This article sets out what a Kenyan firm's due diligence file should contain, where the client can help, and which checks the firm must carry out with tools other than Achekam.
Start with identity and ownership particulars
The most useful template for ownership information already exists in Kenyan law. The Beneficial Ownership Regulations require a company to record, for each beneficial owner, the full name, ID or passport number, KRA PIN, nationality, date of birth, addresses, telephone number, e-mail address, occupation, the nature of the ownership or control, and the dates on which the person became and stopped being a beneficial owner. Under regulation 3(3), the company must validate and verify those particulars before it submits them to the Registrar.
That list is written for the company, not for its accountants. It is still a sensible spine for a firm's own file, because a client that has met its obligations already holds every item on it. Asking for the company's beneficial ownership register, together with copies of the owners' identity documents, gives the firm a record built on the same headings the Registrar uses. How companies prepare that register is covered in the beneficial ownership register and form BOF1.
For the individuals who will instruct the firm, such as directors and the finance lead, keep the same core particulars: name, identity document, KRA PIN and contact details, plus the basis on which they act for the company.
Why the client has answered these questions before
Clients sometimes treat a firm's request as one more piece of bureaucracy. It helps to point out that their bank and their mobile money provider ask the same things. Safaricom states that Kenya's AML/CFT (Amendment) Act, 2023 and the Proceeds of Crime and Anti-Money Laundering Regulations, 2023 require all financial institutions to collect, verify and keep up-to-date beneficial ownership information for every business relationship. That, Safaricom explains, is why it asks M-PESA business customers to update the details of their beneficial owners.
A client that has just refreshed those details for its paybill or its bank has the pack to hand. Ask for the same documents, dated, and note in the file when the client last updated them elsewhere.
Using ownership information for AML purposes
Beneficial ownership information is protected. Regulation 13 of the Beneficial Ownership Regulations lets a company disclose it only to communicate with the owner, to comply with the Regulations, with anti-money laundering or terrorism laws or a court order, or, with the owner's written consent, to a procuring entity in public procurement, a PPP contracting authority or a financial institution. Regulation 12 makes improper disclosure an offence, with a fine of up to twenty thousand shillings or six months' imprisonment.
Two practical consequences follow. First, when the firm asks for the register as part of its anti-money laundering checks, it should say so in the request, so the client knows the ground on which it is handing the information over. Second, once the firm holds the information, it should treat it with the same care: kept in the client's file, used for due diligence, and not passed on casually. The rules on who may see this information are explained in keeping beneficial ownership information confidential.
The supervisory context matters too. The Accountants Act, through section 8A inserted in 2025, makes ICPAK the regulator and supervisor of anti-money laundering, counter-terrorism financing and counter-proliferation financing compliance by the reporting institutions it supervises, with powers of onsite inspection, offsite surveillance and sanctions. What that means for a practice is set out in ICPAK as anti-money laundering supervisor. The full text of the Beneficial Ownership Regulations, including the ownership and control tests and the disclosure rules for nominees, is published on Kenya Law.
What a complete client file holds
A due diligence file that a reviewer can follow without asking questions usually contains:
- The company's registration documents and current list of directors.
- The beneficial ownership register, with the date the client gave it to you.
- Identity documents and KRA PINs for each beneficial owner and each person who instructs the firm.
- A note of the source of the information and how the firm verified it.
- The result of sanctions and PEP screening for each person, with the date and the service used.
- The acceptance decision, who approved it and when.
- A date for the next review, and a record of each review once done.
Item five is the one most often missing, and it is the one Achekam does not do for you.
Acceptance reviews in Achekam
Achekam lets a firm record a client acceptance review after a conflict check against its own clients and contacts, and only a signed-in partner can approve the review. That gives the file a clear decision and a named approver.
Be precise about what the review contains. Customer due diligence in the acceptance review is a tick-box confirmation by the preparer: the preparer confirms the work was done. Achekam runs no automatic identity, registry or sanctions check behind that tick. The evidence that the work was done has to sit somewhere the reviewer can find it.
Sanctions and PEP checks happen elsewhere
Achekam does not screen prospects or clients against sanctions or politically exposed person lists. On a prospect's profile the screening row always reads NOT RUN, and a person's PEP or sanctions status is only what staff have recorded.
So the firm runs that screening with whatever service or list it has chosen, keeps the output, and records the result against the client. If a beneficial owner changes, the screening is repeated for the new person.
Collecting and filing the evidence
Two Achekam features carry most of the paperwork. The RFI console lets staff create, send and track requests to clients for documents, answers and confirmations in one place, whichever screen the request started from. A due diligence request for the ownership register, identity copies and KRA PINs can go out at onboarding and be tracked until the client responds.
What comes back belongs in the Document Centre, which keeps a folder per client and per lead. Staff upload files and folders, keep versions, tag, search, and archive or restore with a reason. A tag such as "CDD" on each document, with the screening printouts in the same folder, means a reviewer can find the whole trail from one search. When the client sends an updated register next year, the new version sits alongside the old one rather than replacing it.
Next step
Pick three active clients and open their files. If any of them lacks a dated ownership register, a screening result or a named approver, start there, and send the outstanding requests before the next engagement begins.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
