Uganda's Anti-Money Laundering Framework: A Practical Compliance Guide

Uganda's anti-money laundering (AML) and counter-terrorism financing (CTF) framework has undergone significant reforms since the enactment of the Proceeds of Crime and Anti-Money Laundering Act, 2013 (POCAMLA). The Financial Intelligence Authority (FIA) has intensified enforcement, and compliance failures now carry substantial penalties including licence revocation.[1]

This guide provides a practical overview of the key obligations under POCAMLA and the accompanying regulations, with a focus on financial institutions and designated non-financial businesses and professions (DNFBPs).

Scope of the Framework

POCAMLA applies to all reporting institutions as defined in Section 2 of the Act. These include:

• Banks and financial institutions licensed under the Financial Institutions Act, 2004
• Microfinance institutions and savings and credit cooperative organisations
• Insurance companies regulated by the Insurance Regulatory Authority
• Designated non-financial businesses and professions, including advocates, accountants, real estate agents, and dealers in precious metals[2]

The FIA has published guidance notes specifying the enhanced due diligence requirements for each category of reporting institution. Failure to comply may result in administrative penalties of up to UGX 500 million or imprisonment of up to seven years for responsible officers.[3]

Customer Due Diligence (CDD)

Section 12 of POCAMLA requires reporting institutions to conduct customer due diligence before establishing a business relationship. The CDD process includes:

1. Identification and verification: Verify the identity of the customer, beneficial owner, and any person acting on behalf of the customer using reliable, independent sources.[4]
2. Purpose and nature of the business relationship: Understand and record the purpose and intended nature of the business relationship.
3. Ongoing monitoring: Monitor the business relationship and transactions to ensure consistency with the institution's knowledge of the customer.

Suspicious Transaction Reporting

Section 16 of POCAMLA requires reporting institutions to file suspicious transaction reports (STRs) with the FIA where there are reasonable grounds to suspect that a transaction:

• Involves the proceeds of crime
• Is related to money laundering
• Is related to the financing of terrorism
• Does not have an apparent lawful purpose

Reports must be filed within 24 hours of the suspicion arising. The FIA has published typologies of suspicious transactions specific to the Ugandan market, including red flags for real estate transactions, cross-border remittances, and trade-based money laundering.[6]

Record Keeping

Section 18 of POCAMLA requires reporting institutions to maintain records of:

• All transactions for at least five years from the date of the transaction
• Customer identification documents for at least five years after the termination of the business relationship
• Internal and external audit reports for at least ten years

Records must be sufficient to permit reconstruction of individual transactions and to provide, if necessary, evidence for prosecution of criminal activity.

AML/CFT Compliance Programme

Every reporting institution must implement a compliance programme that includes:

1. Internal policies and procedures: Written AML/CFT policies approved by senior management and communicated to all staff.
2. Compliance officer: Appointment of a compliance officer at management level who is responsible for overseeing AML/CFT compliance.[7]
3. Training: Regular AML/CFT training for all staff, with enhanced training for customer-facing personnel.
4. Independent audit: Periodic independent review of the AML/CFT programme to assess its effectiveness.

Penalties for Non-Compliance

POCAMLA provides for the following penalties:

• Administrative penalties: The FIA may impose fines of up to UGX 500 million for contravention of the Act.
• Criminal penalties: Money laundering is punishable by imprisonment of up to 15 years or a fine of up to UGX 5 billion, or both.
• licence revocation: The FIA may recommend revocation of a reporting institution's licence for systemic non-compliance.[3]

Compliance with Uganda's AML/CFT framework is not merely a regulatory obligation but a critical risk management function. Institutions that invest in robust compliance programmes protect themselves from legal liability, reputational damage and operational disruption.