Building a crypto AML programme for Kenya and Brazil

Cross Published 2026-08-26

An AML programme written for one regulator rarely survives contact with a second. Kenya and Brazil both expect a documented, board-level programme, but they test it in completely different ways: Kenya through a statutory reporting relationship that is already live, Brazil through an external auditor's opinion delivered inside the authorisation file.

Kenya: the obligations started before the regulations did

The Schedule to the Virtual Asset Service Providers Act, 2025 inserted the words "or a virtual asset service provider" into the definition of reporting institution in section 2 of the Proceeds of Crime and Anti-Money Laundering Act (Cap 59A), with effect from 4 November 2025. That is the most under-noticed fact in the Kenyan build. Firms waiting for Legal Notice No. 134 of 2026 before starting an AML programme had already been reporting institutions for nine months by the time it was gazetted.

The statutory numbers are hard ones:

• Suspicious transaction reports go to the Financial Reporting Centre within two days after the suspicion arose (s. 44(2)), and attempted transactions count (s. 44(3)).
• Cash transaction reports are required above USD 15,000 or the equivalent (s. 44(6) and the Fourth Schedule).
• Findings are retained seven years (s. 44(5)). FRC follow-up must be answered not later than 30 days (s. 44(9)). The FRC may direct a hold of up to five working days (s. 44A).
• Records are kept at least seven years from completion of the transaction or termination of the relationship (s. 46(4)).
• Registration with the FRC, and notification of changes in particulars within 90 days, sit in s. 47A.
• Section 45A requires enhanced due diligence and countermeasures for higher-risk countries, plus an annual list to the FRC of customers from those countries.

The programme design lives in the 2023 Regulations

The Proceeds of Crime and Anti-Money Laundering Regulations, 2023 (Legal Notice No. 153 of 2023) are what an examiner reads your programme against:

• Regulation 7: a documented ML, TF and PF risk assessment, kept current, with board-approved policies under r. 7(3).
• Regulation 8: a risk assessment before launching any new product, practice, delivery mechanism or technology. In practice that means a product-approval gate has to sit inside the risk policy, which is the item crypto firms most often omit.
• Regulation 11: internal controls, meaning an MLRO at management level, screening on hire, ongoing training, an independent audit function and a compliance manual.
• Regulation 12: the MLRO must be at management level and independent, and cannot be the internal auditor or the chief executive unless a sole proprietor. Appointment or removal is notified to the FRC and to the supervisory body within 14 days.
• Regulation 32: full originator and beneficiary data on domestic and cross-border transfers, intermediary records for seven years, and risk-based rules on when to execute, reject or suspend a transfer with missing data. This is Kenya's travel-rule hook for VASPs, and r. 32(8) prohibits transfers to persons designated under UN Security Council resolutions.
• Regulation 44: an annual compliance report due 31 January.

One piece of context changes how a reviewer reads all of it. Kenya remained on the FATF list of jurisdictions under increased monitoring at the plenary of 19 June 2026, with an outstanding action plan that includes risk-based supervision and bringing the targeted financial sanctions framework into compliance. Those are the exact headings your policies will be marked against, because they are the headings your supervisor is being marked against.

Brazil: the programme has to survive somebody else's opinion

Instrucao Normativa BCB no 739, dated 29 May 2026 and published in the Diario Oficial da Uniao of 1 June 2026, added Anexo IV to IN BCB no 704: a reasonable assurance report (relatorio de asseguracao razoavel) issued by an independent audit firm registered with the Comissao de Valores Mobiliarios. Its legal basis is Resolucao BCB no 519 articles 2 paragraph 5 and 4, and its subject matter is the AML and CFT programme under Lei no 9.613/1998. It is not an attestation of prior trading activity, and it is not an attestation of the capital position.

Get the timing right, because a good deal of published commentary does not. IN 739 made exactly four changes: new wording for article 24, and insertions at article 5 inciso XV, article 10 inciso X and Anexo IV. It did not touch article 9. The Phase 1 set due 30 October 2026 is unchanged. The assurance report lands in Phase 2 under article 10 X, and in the new-entrant route under article 5 XV. Any statement that IN 739 added a document to the October filing is wrong, and firms have rebuilt project plans around that error.

What Anexo IV asks about that most programmes do not document

Anexo IV article 1 requires a conclusive opinion on eight heads. Several are routinely missing from programmes written for other jurisdictions:

• Know your partner, as a head separate from know your customer.
• Training that expressly extends to the staff of correspondentes no Pais.
• Suspicious-transaction dossiers formalised with ten-year retention, documented approval authority levels, and Coaf reporting including the prohibition on tipping off.
• Monitoring and analysis of indications of fraud and scams, as a distinct exercise from money laundering monitoring.
• Administrative asset freezing under UN Security Council designations and Resolucao BCB no 44/2020, with communication to the BCB, the Ministry of Justice and Coaf.
• Transaction records under Circular no 3.978/2020 article 28, plus origin and destination of funds under article 30 for payment, receipt and transfer operations.

Two provisos are worth planning around. Anexo IV article 1 paragraph 1 applies some heads only to providers that were in activity on 2 February 2026. Article 1 paragraph 2 allows assurance reports issued in the last twelve months on the same aspects to be considered in forming the opinion, which is a look-back credit rather than a substitute. The norm prescribes no reference period and no as-of date for the report. Do not assume one, and be wary of any timetable that states one as fact.

Sequencing one programme for both

• Write the risk assessment first, and write it for the specific entity. A group framework with no local risk register fails in Kenya against the Third Schedule business-plan content and reads thin against Anexo IV head II.
• Name the people. Kenya requires an MLRO who is neither the chief executive nor the internal auditor. Brazil expects an internal risk assessment approved by the responsible director with the board aware.
• Build retention once, to the longest clock in the set: seven years in Kenya, ten years for Brazilian suspicious-transaction dossiers.
• Book the Brazilian auditor early. You cannot write the report yourself, and Phase 2 must be filed within 60 days of a favourable Phase 1 decision, extendable by up to 60 more at BCB discretion on a justified request.

The checklist behind this article

Each of our readiness checklists carries the AML section for its own regime, with every item cited to a section, regulation or annex, every figure marked as instrument text or as reporting of it, and the open questions left marked open. Kenya, USD 79, Brazil, USD 79, United Kingdom, USD 149. Updated editions are free as the position develops.

If you operate in one market with one AML supervisor, the checklist covers the ground and nothing further is needed. If you are running a single programme across Kenya and Brazil, or your Anexo IV scope is unclear, the 48-hour gap check at this link works through your actual arrangements.