KYC Is a Pan-African Obligation
Know Your Customer (KYC) is not a South African invention. It is a universal compliance obligation mandated by the Financial Action Task Force (FATF) — the intergovernmental body whose 40 Recommendations form the baseline AML/CFT framework adopted by virtually every country on earth. All 54 African nations are either direct FATF members, members of FATF-Style Regional Bodies (FSRBs), or have enacted FATF-aligned national legislation.
For businesses operating across the continent — exporters, financial institutions, fintechs, mining companies, agricultural traders, and textile manufacturers — KYC compliance is a prerequisite for accessing banking services, clearing EU customs, and satisfying the entity verification requirements of the Three Gates Framework. Gate 1 (KYC Identity) must be completed before Gate 2 (CBAM Financial) or Gate 3 (Digital Product Passport) can be accessed.
The FATF Regional Architecture in Africa
Africa's AML/CFT oversight is structured through three FATF-Style Regional Bodies (FSRBs), each covering a distinct geographic zone:
| FSRB | Coverage | Members | Mutual Evaluation Cycle |
|---|---|---|---|
| ESAAMLG | Eastern & Southern Africa | 18 countries incl. SA, Kenya, Tanzania, Zambia, Zimbabwe, Botswana, Ethiopia | 4th Round (2019–ongoing) |
| GIABA | West Africa | 15 ECOWAS states incl. Nigeria, Ghana, Côte d'Ivoire, Senegal | 2nd Round (2020–ongoing) |
| GABAC | Central Africa | 6 CEMAC states incl. DRC (observer), Cameroon, Gabon | 2nd Round (2021–ongoing) |
| MENAFATF | Middle East & North Africa | 21 members incl. Morocco, Egypt, Tunisia, Algeria, Libya | 4th Round (2018–ongoing) |
South Africa is the only African country that is a direct FATF member (admitted 2003). It was placed on the FATF grey list in October 2023 and faces a critical review deadline of 19 July 2026. Nigeria was grey-listed from 2023 and removed in June 2024 following remediation. Both cases illustrate the reputational and commercial consequences of FATF non-compliance for African exporters.
Common KYC Obligations Across All African Jurisdictions
Despite differences in national legislation, all FATF-aligned African jurisdictions share a common core of KYC obligations derived from the FATF 40 Recommendations:
| Obligation | FATF Recommendation | Description |
|---|---|---|
| Customer Identification | R.10 | Verify the identity of customers using reliable, independent source documents before establishing a business relationship |
| Beneficial Ownership | R.24–25 | Identify and verify the natural persons who ultimately own or control a legal entity (typically ≥25% threshold) |
| PEP Screening | R.12 | Apply Enhanced Due Diligence to Politically Exposed Persons and their family members and close associates |
| Sanctions Screening | R.6 | Screen customers against UN Security Council designated lists and national designated persons lists |
| Suspicious Transaction Reporting | R.20 | Report transactions suspected of involving money laundering or terrorist financing to the national FIU |
| Record Keeping | R.11 | Retain CDD records and transaction records for a minimum of 5 years (some jurisdictions require 7–10 years) |
| Risk-Based Approach | R.1 | Apply CDD measures proportionate to the assessed ML/TF risk of the customer, product, and geography |
Country-by-Country KYC Guides
The pages below cover the national AML/KYC framework for each of the 18 priority African jurisdictions targeted by the Three Gates ecosystem. Each page covers the primary legislation, the national Financial Intelligence Unit (FIU), accountable institution categories, key obligations, and sector-specific considerations for exporters operating in that country.
Country Comparison: AML Frameworks at a Glance
The table below compares the 18 priority African jurisdictions covered by the Three Gates ecosystem across the key dimensions that matter for cross-border KYC verification: FATF membership body, primary AML legislation, national FIU, beneficial ownership disclosure threshold, and STR filing deadline.
| Country | FATF Body | Primary AML Law | National FIU | BO Threshold | STR Deadline | FATF Status |
|---|---|---|---|---|---|---|
| South Africa | FATF (direct) | FICA 38/2001 (amend. 2022) | FIC | 5% (PCC 59) | 15 days | Grey-listed (Jul 2026 review) |
| Nigeria | GIABA | MLPPA 2022 | NFIU | 5% | 3 days | Removed from grey list (Jun 2024) |
| Kenya | ESAAMLG | POCAMLA 2009 | FRC | 10% | 3 days | Not grey-listed |
| Ghana | GIABA | AML Act 2008 (amend. 2014) | FIC Ghana | 25% | 3 days | Not grey-listed |
| Ethiopia | ESAAMLG | AML Proc. 780/2013 | NBE (FIU unit) | 20% | 5 days | Not grey-listed |
| Morocco | MENAFATF | Law 43-05 (amend. 2021) | UTRF | 25% | Promptly | Not grey-listed |
| Egypt | MENAFATF | AML Law 80/2002 | EMLCU | 25% | Promptly | Not grey-listed |
| Tunisia | MENAFATF | Law 2015-26 | CTAF | 25% | Promptly | Grey-listed (Oct 2021) |
| DRC | GABAC | AML Law 2004 | CENAREF | 25% | Promptly | Grey-listed (Jun 2022) |
| Zambia | ESAAMLG | AML Act 2010 | FIU Zambia | 25% | Promptly | Grey-listed (Jun 2023) |
| Zimbabwe | ESAAMLG | MLCA 2001 (amend. 2019) | FIU Zimbabwe | 20% | Promptly | Grey-listed (Oct 2019) |
| Botswana | ESAAMLG | POCA 2014 | DCEC | 25% | Promptly | Not grey-listed |
| Rwanda | ESAAMLG | Law 47/2008 | FIU-Rwanda | 25% | 3 days | Not grey-listed |
| Tanzania | ESAAMLG | AML Act 2006 | FIU Tanzania | 25% | Promptly | Not grey-listed |
| Uganda | ESAAMLG | AML Act 2013 | FIA Uganda | 25% | 3 days | Not grey-listed |
| Senegal | GIABA | WAEMU Law 2015 / Law 2018-03 | CENTIF | 25% | Promptly | Not grey-listed |
| Côte d'Ivoire | GIABA | WAEMU / Loi 2016-992 | CENTIF-CI | 25% | 72 hours | Not grey-listed |
| Mozambique | ESAAMLG | Law 14/2013 + Decree 66/2014 | GIFiM | 25% | Promptly | Not grey-listed |
Why African Exporters Must Complete Gate 1 First
The EU's Digital Product Passport (DPP) regulation and the Carbon Border Adjustment Mechanism (CBAM) both require a verified legal entity as the foundation of any compliance filing. EU Customs will not accept a DPP or a CBAM declaration from an unverified entity. This means that KYC — the process of establishing and verifying a business's legal identity against its national business registry — is the mandatory first step for any African exporter seeking EU market access.
The Three Gates Framework formalises this dependency: Gate 1 (KYC Identity, anchored at kycregistry.co.za) must be completed before Gate 2 (CBAM Financial, at carbonborderadjustment.co.za) or Gate 3 (Digital Product Passport, at digitalproductpassports.co.za) can be accessed. A business that has not completed its KYC obligations in its home jurisdiction cannot produce the verified entity record required to mint a DPP or file a CBAM declaration.
The AfCFTA Dimension
The African Continental Free Trade Area (AfCFTA), which entered into force in 2021, is progressively harmonising trade rules across all 54 African Union member states. The AfCFTA Protocol on Trade in Services includes financial services provisions that require member states to maintain FATF-aligned AML/CFT frameworks as a condition of market access. This means that KYC compliance is increasingly a prerequisite not only for EU trade but for intra-African trade as well.
For businesses registered under the AfCFTA framework, the national KYC obligations of the home jurisdiction remain the primary compliance requirement. However, cross-border transactions within the AfCFTA zone may trigger additional CDD obligations in the counterparty's jurisdiction, particularly for financial services, mining royalties, and agricultural commodity payments.