Pack contents: Kenya

In short

Two packs are written for Kenya, in Kenyan shillings (KES). A workspace whose jurisdiction is Kenya (ke) sees them first in the rule library, marked Recommended for its kind of institution:

• ke-psp 1.0.0 (12 rules): mobile money operators, payment service providers and agent networks.
• ke-bank 1.0.0 (9 rules): banks and microfinance banks.

Three rules, ke.ctr_cash (KE1), ke.border_region (KE2) and ke.horn_corridor (KE3), are in both, so there are 18 different rules. All are post-event except ke.sim_swap_payout, which runs in a real-time decision. Every rule arrives switched off, and every rule has a French name and description, shown in a workspace using French (see Languages).

Most rules reuse a core, Ghana, Nigerian or UEMOA rule by reference: they run exactly the same logic with amounts in Kenyan shillings. The pages for those base rules explain how they work.

Nothing on this page is confirmed: verify it with counsel

Every threshold, deadline and detail about the financial intelligence unit here comes from SpeculaPro’s own research of public sources. None has been confirmed by the Central Bank of Kenya or the Financial Reporting Centre (FRC), or reviewed by a lawyer. The packs and the jurisdiction mark each such value to verify with counsel. This page is not legal advice. Before you switch a rule on or rely on a figure, verify it with your legal counsel and your MLRO, and confirm it with the regulator. Each pack below lists what to verify.

Only one amount per pack is a legal figure

The cash reporting threshold is the only amount meant to follow the law, and it is itself to verify. Every other amount is a starting value in Kenyan shillings, chosen to be plausible, not taken from a regulation. Set each for your own customers when you review the rule.

ke.ctr_cash follows your workspace’s cash reporting setting: its comparison parameter defaults to workspace, so whether a transaction of exactly the threshold counts is decided by Report when the day’s cash is under Settings → Reporting, and the rule and the drafted cash transaction reports agree. See At or above, or above only.

ke.border_region needs to know where a transaction took place: send the place in the transaction’s attributes as region, district, town or branch_region. It matches the places named in its regions parameter and any you add to a list with the key high_risk_regions (see Lists).

The threshold is set in US dollars

Kenyan law is understood to set the cash reporting amount in US dollars: USD 10,000, with USD 15,000 reported after a 2023 amendment (to verify with counsel). The packs use the lower figure so nothing reportable is missed, restated as KES 1,300,000 at about KES 130 to the dollar. Keep it in line with the Central Bank of Kenya’s rate.

The shared packs install rough KES amounts

The jurisdiction also recommends core, fraud and global-fatf. From core 1.4.0, fraud 1.4.0 and global-fatf 1.2.0 they install default amounts in Kenyan shillings, so the rule library no longer warns about the currency. Those amounts are the US dollar figures scaled at a rough exchange rate and rounded, with the cash reporting threshold above in the large-cash and structuring rules. They are unverified starting points: review every amount for your customers before you enable a rule. See Packs written in another currency.

All rules at a glance

Key	Library	Name	Pack	Mode · action	Alert about	Severity · score
ke.ctr_cash	KE1	Cash transaction at the FRC reporting threshold	ke-psp	post-event · alert	customer	low · 20
ke.structuring_below_ctr	KE4	Repeated cash-ins just below the reporting threshold	ke-psp	post-event · alert	customer	high · 70
ke.split_cash_in_agents	KE5	Cash-in split across many agents	ke-psp	post-event · alert	customer	high · 70
ke.cash_out_after_cash_in	KE6	Cash-out soon after cash-in	ke-psp	post-event · alert	customer	high · 60
ke.sim_swap_payout	KE7	Payout soon after a SIM swap	ke-psp	real-time · block	customer	critical · 85
ke.cross_border_wallet	KE8	Cross-border mobile money transfer	ke-psp	post-event · alert	customer	medium · 40
ke.collection_wallet_sweep	KE9	Collection wallet swept to a bank	ke-psp	post-event · alert	customer	high · 60
ke.wallet_daily_limit	KE10	Wallet outflows above the daily mobile money limit	ke-psp	post-event · alert	customer	medium · 45
ke.near_txn_limit	KE11	Transfers just below the M-Pesa transaction limit	ke-psp	post-event · alert	customer	medium · 50
ke.wallet_balance_cap	KE12	Wallet balance above the mobile money cap	ke-psp	post-event · alert	account	medium · 40
ke.border_region	KE2	Cash or wallet activity in a border or mining area	ke-psp	post-event · alert	customer	medium · 40
ke.horn_corridor	KE3	Transfer on a Horn of Africa or conflict corridor	ke-psp	post-event · alert	customer	high · 60
ke.ctr_cash	KE1	Cash transaction at the FRC reporting threshold	ke-bank	post-event · alert	customer	low · 20
keb.deposit_structuring	KEB1	Cash deposits just below the reporting threshold	ke-bank	post-event · alert	customer	high · 70
keb.pep_large	KEB2	PEP transaction above KES 650,000	ke-bank	post-event · alert	customer	high · 70
keb.dormant_reactivation	KEB3	Dormant account suddenly active	ke-bank	post-event · alert	customer	medium · 45
keb.new_payee_large	KEB4	Large PesaLink transfer to a new payee	ke-bank	post-event · alert	customer	medium · 50
keb.fx_cash	KEB5	Foreign-currency cash of USD 10,000 or more	ke-bank	post-event · alert	customer	medium · 40
keb.commodity_trade_hubs	KEB6	Gold or import-export trader paying or paid from a trading hub	ke-bank	post-event · alert	customer	medium · 50
ke.border_region	KE2	Cash or wallet activity in a border or mining area	ke-bank	post-event · alert	customer	medium · 40
ke.horn_corridor	KE3	Transfer on a Horn of Africa or conflict corridor	ke-bank	post-event · alert	customer	high · 60

The ke-psp pack (12 rules)

Kenya mobile money, PSP and agents (in French: Kenya : mobile money, PSP et agents), version 1.0.0.

Typologies for Kenya’s mobile money operators, payment service providers, digital lenders and agent networks (M-Pesa, Airtel Money and T-Kash), in shillings: the FRC cash reporting threshold and structuring below it, smurfing through agents, cash moved through a wallet, SIM-swap payouts, cross-border wallet transfers, collection wallets swept to a bank, activity in border and mining areas and the Central Bank of Kenya’s M-Pesa-era wallet limits (KES 250,000 per transaction, KES 500,000 a day and as a balance), transfers split to fit them, till and paybill collections swept to a bank, and the Horn of Africa corridors. Most rules reuse core, Ghana and Nigeria rules by reference with local amounts. Values come from SpeculaPro’s research, not from an official confirmation: to verify with counsel, and confirm each with the Central Bank of Kenya and the FRC before go-live.

To verify with counsel

None of these is confirmed. They come from SpeculaPro’s research, not from the regulator or a lawyer. This is not legal advice: verify each with counsel and confirm it with the regulator before relying on it:

• To verify with counsel: the cash transaction reporting threshold (USD 10,000 used, KES 1,300,000 at about KES 130 to the dollar; USD 15,000 after the 2023 amendment is reported) and same-day aggregation
• The places in the border and mining area rule: add your own on the high_risk_regions list
• Every amount that isn’t the CTR threshold is a starting value in shillings, not a regulatory figure: set it for your customers
• Mobile money limits approved by the Central Bank of Kenya in August 2023: KES 250,000 per transaction, KES 500,000 a day and as a wallet balance

Sources the pack cites:

• Proceeds of Crime and Anti-Money Laundering Act, 2009 (ss. 44, 46; Fourth Schedule), as amended in 2023
• Central Bank of Kenya: mobile money wallet and transaction limits (August 2023)
• ESAAMLG: mutual evaluation report of Kenya (2022)

ke.ctr_cash

Cash transaction at the FRC reporting threshold · library KE1 · Cash reporting threshold (CTR) · alert about the customer · severity low, score 20

In French: Opération en espèces au seuil de déclaration de le FRC.

Cash deposits, withdrawals, cash-ins and cash-outs of KES 1,300,000 or more: a cash transaction report to the FRC is due (POCAMLA s.44(6) and Fourth Schedule: USD 10,000 or its equivalent, about KES 130 to the dollar). Whether a transaction of exactly the threshold counts follows the workspace’s CTR setting (Settings → Reporting), which starts as “at or above” in Kenya, so this rule and the CTR drafts always agree. To verify with counsel, and confirm the thresholds and their application with the FRC. Reuses the Nigerian CTR rule with Kenya’s amounts.

Reuses the logic of ng.ctr_cash (from ng-psp) with the parameters below; only the values differ.

Parameter	Meaning	Default
threshold_individual	Individuals: above (base currency)	1,300,000
threshold_business	Businesses: above (base currency)	1,300,000
comparison	Report when the amount is: what Settings → Reporting says for CTRs (workspace), above the threshold (gt), or at or above it (gte)	"workspace"

Explanation shown to analysts: Cash {{txn.type}} of {{txn.base_currency}} {{txn.amount}} by {{= customer.type == ‘business’ ? ‘a business’ : ‘an individual’ }} is {{= (params.comparison == ‘workspace’ ? workspace.ctr_comparison : params.comparison) == ‘gte’ ? ‘at or above’ : ‘above’ }} the FRC cash reporting threshold. Confirm with current FRC guidance.

ke.structuring_below_ctr

Repeated cash-ins just below the reporting threshold · library KE4 · Structuring / smurfing · alert about the customer · severity high, score 70

In French: Dépôts d’espèces répétés juste sous le seuil de déclaration.

Cash-ins just below KES 1,300,000 repeated within 48 hours and together above it: structuring to avoid a cash transaction report to the FRC. Reuses the core structuring rule with Kenya’s threshold.

Reuses the logic of core.structuring (from core) with the parameters below; only the values differ.

Parameter	Meaning	Default
threshold	Threshold being avoided	1,300,000
margin	Margin below threshold (0.10 = 10%)	0.1
min_count	Minimum cash-ins in 48h	3

Explanation shown to analysts: {{features.cash_in_count_48h}} cash-ins totalling {{txn.base_currency}} {{features.cash_in_sum_48h}} in 48h; this one ({{txn.base_currency}} {{txn.amount}}) is just below the {{txn.base_currency}} {{params.threshold}} FRC reporting threshold.

ke.split_cash_in_agents

Cash-in split across many agents · library KE5 · Smurfing through agents · alert about the customer · severity high, score 70

In French: Dépôts d’espèces répartis entre de nombreux agents.

Cash-ins through several agents in a day adding up to a large sum: smurfing through the agent network of M-Pesa, Airtel Money and T-Kash. Reuses the Ghana rule with an amount in shillings.

Reuses the logic of gh.split_cash_in_agents (from gh-psp) with the parameters below; only the values differ.

Parameter	Meaning	Default
min_agents	Distinct agents in 24h	4
min_total	Total cash-in in 24h (base currency)	150,000

Explanation shown to analysts: Cash-ins via {{features.agents_24h}} different agents totalling {{txn.base_currency}} {{features.cash_in_24h}} in 24h.

ke.cash_out_after_cash_in

Cash-out soon after cash-in · library KE6 · Wallet used as pass-through · alert about the customer · severity high, score 60

In French: Retrait d’espèces peu après un dépôt.

Most of what was cashed in at an agent is cashed out within two hours, often in another town: the wallet is used to move cash, not to hold or spend it. Reuses the Ghana rule with an amount in shillings.

Reuses the logic of gh.cash_out_after_cash_in (from gh-psp) with the parameters below; only the values differ.

Parameter	Meaning	Default
min_amount	Minimum cash-in (base currency)	70,000
ratio	Cash-out as share of cash-in	0.8

Explanation shown to analysts: {{txn.base_currency}} {{features.cash_in_2h}} cashed in and {{txn.base_currency}} {{features.cash_out_2h}} cashed out within 2 hours.

ke.sim_swap_payout

Payout soon after a SIM swap · library KE7 · SIM swap · real-time, answers block · about the customer · severity critical, score 85

In French: Paiement peu après un changement de carte SIM.

SIM-swap fraud: the fraudster has the customer’s number moved to another SIM, receives the PIN reset and one-time codes and empties the wallet. Reuses the Ghana rule with an amount in shillings.

Reuses the logic of gh.sim_swap_payout (from gh-psp) with the parameters below; only the values differ.

Parameter	Meaning	Default
sim_change_hours	Hours since the SIM swap	48
threshold	Payout at or above (base currency)	10,000

Explanation shown to analysts: SIM swapped {{customer.hours_since.sim_swap}} hours before this payout of {{txn.base_currency}} {{txn.amount}} (rule window: {{params.sim_change_hours}} hours).

ke.cross_border_wallet

Cross-border mobile money transfer · library KE8 · Cross-border mobile money · alert about the customer · severity medium, score 40

In French: Transfert mobile money transfrontalier.

A wallet transfer to or from another country at or above the amount. The main corridors are Uganda, Tanzania, Rwanda and, for remittances, Somalia and South Sudan; cross-border wallets carry informal trade and remittances, and with them cash-courier and exchange-control risk. Leave the corridor list empty to watch every country, or name the ones to watch.

Parameter	Meaning	Default
home_country	Home country (ISO code)	"KE"
corridors	Only these countries (ISO codes; empty = every other country)	[]
min_amount	Amount at or above (base currency)	70,000

Explanation shown to analysts: {{txn.base_currency}} {{txn.amount}} by mobile money to/from {{txn.counterparty_country}}, outside Kenya.

Expression

txn.channel == 'momo' && txn.amount >= params.min_amount && txn.counterparty_country != '' && txn.counterparty_country != params.home_country && (size(params.corridors) == 0 || txn.counterparty_country in params.corridors)

ke.collection_wallet_sweep

Collection wallet swept to a bank · library KE9 · Collection wallet · alert about the customer · severity high, score 60

In French: Porte-monnaie de collecte vidé vers une banque.

Many senders pay into one wallet, till or paybill over a week and most of it then leaves to a bank account: a collection point for a scam, an unlicensed fundraiser or betting operation, or a mule. Reuses the Ghana rule.

Reuses the logic of gh.wallet_sweep_to_bank (from gh-psp) with the parameters below; only the values differ.

Parameter	Meaning	Default
min_senders	Distinct senders in 7 days	10
sweep_ratio	Transfer as share of 7-day inflow	0.7

Explanation shown to analysts: {{features.senders_7d}} senders paid in {{txn.base_currency}} {{features.in_7d}} over 7 days; {{txn.base_currency}} {{txn.amount}} is now leaving to a bank.

ke.wallet_daily_limit

Wallet outflows above the daily mobile money limit · library KE10 · Wallet limit breach · alert about the customer · severity medium, score 45

In French: Sorties de porte-monnaie au-dessus du plafond journalier du mobile money.

A customer’s mobile money outflows above KES 500,000 in 24 hours, the daily limit the Central Bank of Kenya approved in August 2023 (KES 250,000 per transaction, KES 500,000 a day and as a wallet balance). One line can’t exceed it, so the customer is using several lines or wallets: the usual way round the limit.

Parameter	Meaning	Default
daily_limit	Daily mobile money limit (base currency)	500,000

Explanation shown to analysts: {{txn.base_currency}} {{features.momo_out_24h}} sent by mobile money in 24 hours, above the {{txn.base_currency}} {{params.daily_limit}} daily limit.

Expression

txn.channel == 'momo' && txn.direction == 'out' && features.momo_out_24h > params.daily_limit

ke.near_txn_limit

Transfers just below the M-Pesa transaction limit · library KE11 · Structuring below the wallet transaction limit · alert about the customer · severity medium, score 50

In French: Transferts juste sous le plafond par opération M-Pesa.

A wallet transfer just below the KES 250,000 per-transaction limit when the customer has already sent a large amount that day: a larger payment split to fit the limit, as seen in land, vehicle and gold deals settled by M-Pesa and in the cashing out of fraud proceeds.

Parameter	Meaning	Default
txn_limit	Per-transaction limit (base currency)	250,000
margin	Share below the limit that counts as just below	0.1
min_total	Mobile money sent in 24 hours, at or above (base currency)	450,000

Explanation shown to analysts: {{txn.base_currency}} {{txn.amount}} sent, just below the {{txn.base_currency}} {{params.txn_limit}} transaction limit; {{txn.base_currency}} {{features.momo_out_24h}} sent by mobile money in 24 hours.

Expression

txn.channel == 'momo' && txn.direction == 'out' && txn.amount >= params.txn_limit * (1.0 - params.margin) && txn.amount <= params.txn_limit && features.momo_out_24h >= params.min_total

ke.wallet_balance_cap

Wallet balance above the mobile money cap · library KE12 · Wallet limit breach · alert about the account · severity medium, score 40

In French: Solde de porte-monnaie au-dessus du plafond du mobile money.

A wallet balance above KES 500,000 after a transaction, the maximum balance the Central Bank of Kenya approved in August 2023. Send the balance in txn.attributes.balance_after; agent, merchant (till and paybill) and distributor accounts are exempt. Reuses the UEMOA e-money balance rule with Kenya’s cap.

Reuses the logic of uemoa.emi_balance_cap (from uemoa-emi) with the parameters below; only the values differ.

Parameter	Meaning	Default
max_balance	Balance cap today (base currency)	500,000
max_balance_new	Balance cap from the date below (base currency)	500,000
new_limit_from	New cap applies from (YYYY-MM-DD, by the transaction’s date; empty: never)	""
exempt_segments	Exempt customer segments	["agent", "distributor", "merchant"]
exempt_account_types	Exempt account types	["agent", "merchant"]

Explanation shown to analysts: Balance of {{txn.base_currency}} {{txn.attributes.balance_after}} after this transaction, above the {{txn.base_currency}} {{= params.new_limit_from != ‘’ && txn.date >= params.new_limit_from ? params.max_balance_new : params.max_balance }} e-money cap.

ke.border_region

Cash or wallet activity in a border or mining area · library KE2 · Border / cash courier risk · alert about the customer · severity medium, score 40

In French: Opération en espèces ou par porte-monnaie dans une zone frontalière ou minière.

A cash or mobile money transaction at or above the amount in an area named in the rule or on the workspace’s high_risk_regions list: by default the north-eastern counties and crossings on the Somalia and Ethiopia borders (Mandera, Garissa, Wajir, Liboi, Moyale) and the Uganda and Tanzania crossings (Busia, Malaba, Namanga, Isebania, Lunga Lunga). Cash couriers, smuggling proceeds and informal cross-border trade concentrate there. Send the place in txn.attributes (region, district, town or branch_region). Reuses the Ghana border-area rule with Kenya’s places and an amount in shillings.

Reuses the logic of gh.border_region (from gh-psp) with the parameters below; only the values differ.

Parameter	Meaning	Default
regions	Areas (towns, districts or regions)	["Mandera", "Garissa", "Wajir", "Liboi", "Moyale", "Lamu", "Busia", "Malaba", "Namanga", "Isebania", "Lunga Lunga", "Eastleigh"]
channels	Only these channels (empty = all)	["cash", "agent", "branch", "momo"]
min_amount	Amount at or above (base currency)	50,000

Explanation shown to analysts: {{txn.base_currency}} {{txn.amount}} by {{txn.channel}} in {{= [‘region’, ‘district’, ‘town’, ‘branch_region’].filter(k, k in txn.attributes).map(k, string(txn.attributes[k])).join(’, ’) }}, a border or high-risk area.

ke.horn_corridor

Transfer on a Horn of Africa or conflict corridor · library KE3 · High-risk corridor (terrorism financing) · alert about the customer · severity high, score 60

In French: Transfert sur un corridor de la Corne de l’Afrique ou d’une zone de conflit.

A transfer to or from Somalia, South Sudan, Sudan, Yemen or the Democratic Republic of the Congo at or above the amount. Kenya’s national risk assessment and its 2022 mutual evaluation rate terrorism financing (Al-Shabaab) and informal remittances (hawala) on these corridors as the country’s highest risks; most such transfers are family remittances, so tune the amount and countries to your customers.

Parameter	Meaning	Default
countries	Corridor countries (ISO codes)	["SO", "SS", "SD", "YE", "CD"]
min_amount	Amount at or above (base currency)	50,000

Explanation shown to analysts: {{txn.base_currency}} {{txn.amount}} {{txn.direction}} with {{txn.counterparty_country}}, a corridor rated high for terrorism financing and informal remittances.

Expression

txn.counterparty_country in params.countries && txn.amount >= params.min_amount

The ke-bank pack (9 rules)

Kenya banks (in French: Kenya : banques), version 1.0.0.

Typologies for Kenya’s commercial banks, microfinance and other deposit-taking institutions, in shillings: the FRC cash reporting threshold and deposits structured below it, PEP activity, dormant accounts, large transfers to new payees, foreign-currency cash, commodity traders dealing with trading hubs, activity in border and mining areas, and the Horn of Africa corridors. Most rules reuse core, Ghana and Nigeria rules by reference with local amounts. Values come from SpeculaPro’s research, not from an official confirmation: to verify with counsel, and confirm each with the Central Bank of Kenya and the FRC before go-live.

To verify with counsel

None of these is confirmed. They come from SpeculaPro’s research, not from the regulator or a lawyer. This is not legal advice: verify each with counsel and confirm it with the regulator before relying on it:

• To verify with counsel: the cash transaction reporting threshold (USD 10,000 used, KES 1,300,000 at about KES 130 to the dollar; USD 15,000 after the 2023 amendment is reported) and same-day aggregation
• The places in the border and mining area rule: add your own on the high_risk_regions list
• Every amount that isn’t the CTR threshold is a starting value in shillings, not a regulatory figure: set it for your customers
• Foreign-currency cash threshold USD 10,000 and its equivalent in shillings (threshold_base), to keep in line with the exchange rate

Sources the pack cites:

• Proceeds of Crime and Anti-Money Laundering Act, 2009 (ss. 44, 46; Fourth Schedule), as amended in 2023
• Central Bank of Kenya: mobile money wallet and transaction limits (August 2023)
• ESAAMLG: mutual evaluation report of Kenya (2022)

keb.deposit_structuring

Cash deposits just below the reporting threshold · library KEB1 · Structuring / smurfing · alert about the customer · severity high, score 70

In French: Dépôts d’espèces juste sous le seuil de déclaration.

Cash deposits at the counter just below KES 1,300,000, repeated within 48 hours and together above it: structuring to avoid a cash transaction report to the FRC. Reuses the Nigerian bank rule with Kenya’s threshold.

Reuses the logic of ngb.deposit_structuring (from ng-bank) with the parameters below; only the values differ.

Parameter	Meaning	Default
threshold	Threshold being avoided (base currency)	1,300,000
margin	Just below = within (0.1 = 10%)	0.1
min_count	Deposits in 48 hours, at least	3

Explanation shown to analysts: {{features.deposits_48h}} cash deposits totalling {{txn.base_currency}} {{features.deposit_sum_48h}} in 48 hours; this one ({{txn.base_currency}} {{txn.amount}}) is just below the {{txn.base_currency}} {{params.threshold}} threshold.

keb.pep_large

PEP transaction above KES 650,000 · library KEB2 · Politically exposed person · alert about the customer · severity high, score 70

In French: Opération d’une PPE au-dessus de 650 000 KES.

A politically exposed person’s transaction at or above the amount: enhanced due diligence and senior management approval apply to PEPs under the Central Bank of Kenya’s AML/CFT rules and FATF Recommendation 12. The amount is a starting value, not a legal threshold. Reuses the core PEP rule with an amount in shillings.

Reuses the logic of core.pep_threshold (from core) with the parameters below; only the values differ.

Parameter	Meaning	Default
threshold	Threshold (base currency)	650,000

Explanation shown to analysts: Customer is a PEP; transaction of {{txn.base_currency}} {{txn.amount}} is at or above {{txn.base_currency}} {{params.threshold}}.

keb.dormant_reactivation

Dormant account suddenly active · library KEB3 · Dormant account reactivation · alert about the customer · severity medium, score 45

In French: Compte dormant redevenu soudainement actif.

An account with no activity for 90 days suddenly moving money: takeover, or reuse as a mule account. Reuses the core rule with an amount in shillings.

Reuses the logic of core.dormant_reactivation (from core) with the parameters below; only the values differ.

Parameter	Meaning	Default
dormant_days	Minimum account age (days); the quiet period is fixed at 90 days	90
min_amount	Minimum amount (base currency)	100,000

Explanation shown to analysts: No activity in the 90 days before today on an account {{account.age_days}} days old, then {{txn.base_currency}} {{txn.amount}}.

keb.new_payee_large

Large PesaLink transfer to a new payee · library KEB4 · Authorised push-payment fraud · alert about the customer · severity medium, score 50

In French: Virement PesaLink important vers un nouveau bénéficiaire.

A large PesaLink transfer to a payee the customer has never paid: authorised push payment fraud and account takeover. Reuses the Ghana instant-payment rule with an amount in shillings.

Reuses the logic of ghb.gip_new_payee_large (from gh-bank) with the parameters below; only the values differ.

Parameter	Meaning	Default
threshold	Amount at or above (base currency)	400,000

Explanation shown to analysts: First instant transfer to this beneficiary: {{txn.base_currency}} {{txn.amount}}.

keb.fx_cash

Foreign-currency cash of USD 10,000 or more · library KEB5 · Foreign-currency cash reporting · alert about the customer · severity medium, score 40

In French: Espèces en devises de 10 000 USD ou plus.

Cash in a foreign currency of USD 10,000 or more (or the same in euros or pounds), or worth KES 1,300,000 or more: the amount POCAMLA’s Fourth Schedule sets for cash transaction reports, read on the foreign-currency amount so a rate movement never hides one (to verify with counsel; USD 15,000 after the 2023 amendment is reported). Reuses the Ghana foreign-currency cash rule.

Reuses the logic of ghb.fx_cash (from gh-bank) with the parameters below; only the values differ.

Parameter	Meaning	Default
threshold	Threshold in the transaction’s currency (major units, with that currency’s decimals)	10,000
threshold_base	Or at or above this in the base currency (0: off)	1,300,000
currencies	Currencies	["USD", "EUR", "GBP"]

Explanation shown to analysts: Cash {{txn.type}} in {{txn.currency}} worth {{txn.base_currency}} {{txn.amount}}: at or above the {{params.threshold}} foreign-currency cash threshold. Confirm the threshold with current FRC guidance.

keb.commodity_trade_hubs

Gold or import-export trader paying or paid from a trading hub · library KEB6 · Commodity trade / trade-based money laundering · alert about the customer · severity medium, score 50

In French: Négociant en or ou en import-export en relation avec une place de négoce.

Kenya is a transit point for gold from the Democratic Republic of the Congo and South Sudan on its way to Dubai, and for trade-based laundering through import-export firms (national risk assessment; FATF mutual evaluation 2022): a trader in those sectors moving money with the Emirates, the DRC, South Sudan, Hong Kong or China outside its declared trade deserves a look. Matches a business whose segment, or customer.attributes.sector, is one of the sectors, on a payment to or from one of the hubs at or above the amount.

Parameter	Meaning	Default
sectors	Customer sectors (segment or attributes.sector, lower case; empty = every business)	["gold", "mining", "precious_metals", "import_export"]
hubs	Trading hub countries (ISO codes)	["AE", "CD", "SS", "HK", "CN"]
min_amount	Amount at or above (base currency)	1,300,000

Explanation shown to analysts: {{txn.base_currency}} {{txn.amount}} {{txn.direction}} with {{txn.counterparty_country}}, a trading hub for this customer’s sector.

Expression

customer.type == 'business' && txn.counterparty_country in params.hubs && txn.amount >= params.min_amount && (size(params.sectors) == 0 || customer.segment.lowerAscii() in params.sectors || ('sector' in customer.attributes && string(customer.attributes.sector).lowerAscii() in params.sectors))

Also in this pack, described above:

Key	Library	Name
ke.ctr_cash	KE1	Cash transaction at the FRC reporting threshold
ke.border_region	KE2	Cash or wallet activity in a border or mining area
ke.horn_corridor	KE3	Transfer on a Horn of Africa or conflict corridor

Related

• Pack contents
• Jurisdictions
• Pack contents: FATF baseline
• Pack contents: Nigeria
• Installing a pack