ICPAK as anti-money laundering supervisor
How the 2025 amendment to the Accountants Act made ICPAK an AML supervisor, the penalties it sets, and how a Kenyan firm can prepare.
By Achekam · · 5 min read · For Accountants & audit firms in Kenya
For years, most Kenyan accountants thought of ICPAK as the body that issues practising certificates, collects subscriptions and counts CPD hours. Anti-money laundering felt like something for banks. That picture changed in 2025.
An amendment to the Accountants Act gave ICPAK a supervisory role over anti-money laundering, counter-terrorism financing and counter-proliferation financing, along with real enforcement powers and a penalty regime. For a partner, the question is no longer whether the institute cares about client due diligence, but whether the firm could show its work if an inspector arrived on Monday.
What the 2025 amendment changed
Section 8A, inserted into the Accountants Act by Act No. 6 of 2025, makes ICPAK the regulator and supervisor of compliance with anti-money laundering, counter-terrorism financing and counter-proliferation financing obligations by the reporting institutions it supervises.
Read that wording carefully. The supervision attaches to reporting institutions that fall under ICPAK. Whether a particular practice, or a particular line of its work, falls into that group is a question the firm should settle with ICPAK and its own legal advisers rather than assume either way. A firm that does only statutory audits may reach a different answer from one that also forms companies, acts as company secretary or handles client money. Write the conclusion down, with the reasoning, because it will be the first thing a supervisor asks about.
This sits alongside ICPAK's older functions rather than replacing them. Section 18 of the consolidated Act on Kenya Law (the version dated 20 June 2025) still says no one may practise as an accountant without a practising certificate and a licence to practise in force, and makes breach an offence carrying a fine of up to five hundred thousand shillings or up to three years' imprisonment. What counts as practising is unpacked in what "practising accountancy" means in Kenya.
Inspections, surveillance and sanctions
Section 8A gives ICPAK three tools.
| Power | What it looks like for a firm |
|---|---|
| Onsite inspection | Someone from the supervisor visits and reviews files, policies and records in person |
| Offsite surveillance | The supervisor asks for information, returns or documents and reviews them remotely |
| Sanctions | The supervisor acts on breaches it finds |
None of these needs a complaint to trigger it. A firm should expect to be asked how it identifies clients and their owners, how it assesses risk, how it screens for sanctions and politically exposed persons, and how it keeps the evidence.
The penalties in section 8B
Section 8B, inserted by the same 2025 amendment, sets the penalties for breaching ICPAK's anti-money laundering and counter-terrorism financing rules: up to five million shillings for a legal person, up to one million shillings for a natural person, and in either case up to one hundred thousand shillings for each day the breach continues.
The daily element is the one to note. A gap that sits unfixed after it has been identified keeps adding to the exposure. The separate disciplinary route for members, covered in ICPAK's disciplinary process, is a different matter from these statutory penalties, and a serious failure could engage both.
Beneficial ownership information and AML
Knowing who ultimately owns or controls a client is at the centre of due diligence. Kenyan companies keep that information under the Beneficial Ownership Regulations, and regulation 13 limits when a company may disclose it. Among the permitted grounds are communicating with the owner, complying with the Regulations, complying with anti-money laundering or terrorism laws or a court order, and, with the owner's written consent, disclosure to a procuring entity, a PPP contracting authority or a financial institution. Regulation 12 makes improper disclosure an offence, punishable by a fine of up to twenty thousand shillings or six months' imprisonment.
For a firm, that means two things. When requesting a client's register for due diligence, name the anti-money laundering purpose in the request. And once the register is on file, protect it: it is not material to circulate among staff who do not need it. A fuller list of what to hold for each client is in client due diligence records for Kenyan firms.
What Achekam records, and what it does not screen
Firms should know exactly where their practice software stops, because an inspector will.
What Achekam does: a firm can record a client acceptance review after running a conflict check against its own clients and contacts, and only a signed-in partner can approve that review. The decision, and the partner who made it, are on record.
What it does not do:
- No automatic due diligence checks. In the acceptance review, customer due diligence is a tick-box confirmation by the preparer. Achekam runs no automatic identity, registry or sanctions check behind it.
- No sanctions or PEP screening. Achekam does not screen prospects or clients against sanctions or PEP lists. The screening row on a prospect's profile always reads NOT RUN, and a person's PEP or sanctions status is only what staff record.
- No compliance profiles. Achekam does not keep client compliance profiles such as AML risk ratings, identity document packs or PEP screening results. The Compliance Profiles page says so plainly and lists only clients that are missing a registration or income tax number.
The practical upshot is that the risk rating, the screening and the identity evidence live in the firm's own process and files. Achekam holds the acceptance decision and the conflict check; the firm holds everything that proves the decision was sound.
A readiness checklist for partners
Before ICPAK asks, a firm can work through these points:
- Record the firm's conclusion on whether it, or any of its services, falls within the reporting institutions ICPAK supervises, and why.
- Write a short AML policy that names the partner responsible and covers identification, ownership, risk assessment, screening and record-keeping.
- Choose a sanctions and PEP screening service, and decide when screening is repeated.
- For each active client, confirm the file holds a dated ownership register, identity evidence and a screening result.
- Check that every acceptance review has a partner approval and a documented conflict check.
- Train staff on what to do if something looks wrong, and keep the attendance record.
- Set a date to test the files again, and note what the test found.
The full Accountants Act, which establishes ICPAK and sets the rules on registration, practising certificates, licences and discipline, can be read on Kenya Law, where the 2025 amendments appear in the consolidated text.
Where to begin
Start with item one. A firm that has thought through whether and how the supervision applies to it will find every other step easier to scope, and will have a clear answer ready on the day the question is put.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
