AML/KYC Compliance Statement

This statement explains how the Ustawi platform supports the anti-money-laundering (AML), counter-financing-of-terrorism (CFT), and know-your-customer (KYC) obligations of tenant institutions using the Service. It does not itself constitute legal or compliance advice, and does not substitute for a tenant institution's own AML/CFT policy, staff training, or regulatory relationship with its supervisor.

Ustawi provides software tooling to support AML/KYC processes. The tenant institution — as the licensed/regulated lender or deposit-taker — remains solely responsible for: maintaining its own board-approved AML/CFT policy; designating a Money Laundering Reporting Officer (MLRO); training staff; making the final determination on suspicious activity; and submitting statutory filings to the Financial Intelligence Unit (FIU) or other regulator. Ustawi is not a reporting entity in its own right and does not make filing decisions on a tenant's behalf.

The platform captures and stores borrower identity data during onboarding, including national ID (NIDA) information, photograph, and address, to support the tenant's own customer due diligence process. Collateral and guarantor identity data is captured similarly where those apps are enabled.

The platform runs sanctions and politically-exposed-person (PEP) screening against borrower and, where applicable, guarantor identity data at onboarding and can be configured to re-screen periodically. Screening alerts (hits) are surfaced to designated compliance staff for review and resolution within the tenant's own workflow — the platform does not auto-clear or auto-reject a hit; a human compliance decision is required.

Where a tenant's compliance staff identify a suspicious transaction, the platform supports recording and progressing an STR case, tracking a 24-hour STR reporting clock from the point the required suspicion is formed, and exporting the report in goAML-compatible format for submission to the FIU. Under Tanzania's anti-money-laundering framework a reporting entity must file a Suspicious Transaction Report promptly once a suspicion is formed; the platform tracks a 24-hour reporting clock from the point the suspicion is formed (confirm the timing against the current requirements of the Financial Intelligence Unit and the Anti-Money Laundering Act). Filing itself is submitted by the tenant's own MLRO/compliance team via the relevant regulator's channel — Ustawi's export tooling does not submit the filing automatically.

The platform restricts visibility of an STR case and related screening detail to designated compliance roles, consistent with legal prohibitions on "tipping off" a subject of an active investigation. Tenant admins are responsible for assigning these roles correctly within their own staff structure.

Every screening alert and STR case action is recorded in the platform's audit log, giving the tenant (and, on request, its supervisor) a complete record of who reviewed and resolved each item and when.

AML/KYC records, including screening results and STR case history, are retained per the retention terms described in the Privacy Policy (/legal/privacy-policy) and the tenant's own statutory record-keeping obligations. Indicatively, AML/KYC records are retained for at least 7 years after the end of the customer relationship or the date of the relevant transaction, whichever is later (indicative demo figure — confirm against current Financial Intelligence Unit and Bank of Tanzania record-keeping requirements).

The platform's compliance and reporting tooling is designed with Bank of Tanzania (BOT) microfinance regulatory alignment as an explicit goal (e.g. PAR/classification/provisioning reporting, recovery-notice-gated repossession, statutory-clock complaints handling). This describes design intent and tooling capability, not a claim of Ustawi holding any license itself — see /legal/regulatory-disclosures for the formal licensing-status statement.

This statement may be updated to reflect platform changes or regulatory developments; the "Last updated" date reflects the latest revision.

Compliance-tooling questions: /contact. Formal licensing/regulatory-status questions: see /legal/regulatory-disclosures.