Question 1

What is Zimbabwe's principal AML/CFT/CPF law?

Accepted Answer

The Money Laundering and Proceeds of Crime Act [Chapter 9:24]. The FIU's current consolidated copy includes amendments through Act 7 of 2025, including virtual-asset and proliferation-financing changes.

Question 2

Who receives suspicious transaction reports?

Accepted Answer

The Financial Intelligence Unit of Zimbabwe. Reporting institutions use the FIU's goAML platform.

Question 3

When is an STR due?

Accepted Answer

Promptly and no later than three working days after suspicion is formed. Attempted transactions are included.

Question 4

Does an amount have to be reached before filing an STR?

Accepted Answer

No. Suspicion reporting is independent of value. A transaction can require both an STR and a separate threshold report.

Question 5

What is the general occasional-transaction CDD threshold?

Accepted Answer

USD 5,000 or more, including linked transactions, for the general statutory trigger. Suspicion or doubt about earlier identity evidence triggers CDD regardless of value, and sector-specific thresholds also exist.

Question 6

What is the wire-transfer CDD threshold?

Accepted Answer

USD 1,000 or more for a domestic or international wire, subject to any later prescribed change.

Question 7

Which company beneficial-owner threshold applies?

Accepted Answer

Company law uses more than 20% of shares or voting rights, majority-director appointment or removal rights, or other significant influence or control. The company must file material changes within seven days.

Question 8

Why does the guide also mention 25% and 10%?

Accepted Answer

They belong to different rules. The AML Act contains a 25%-or-more deemed ownership test, while the June 2025 RBZ guideline directs banks and microfinance institutions to identify and verify beneficial owners at 10% ownership and above. Control must still be assessed.

Question 9

Can a registry extract replace independent KYB?

Accepted Answer

No. Verify legal existence, authority, directors, licences, tax and ownership evidence and reconcile discrepancies. Trace ownership and control to natural persons.

Question 10

What happens if CDD cannot be completed?

Accepted Answer

Do not establish or maintain the relationship and report immediately to the FIU as required. If continued CDD would tip off a suspected customer, stop that process and file the appropriate report.

Question 11

What PEP controls apply?

Accepted Answer

Determine whether the customer or beneficial owner is a PEP, obtain senior-management approval where required, establish source of wealth and funds or assets and apply increased monitoring. Cover family and close associates in the cases described by the RBZ guideline.

Question 12

What automatic threshold reports apply to banks?

Accepted Answer

Under FIU Directive 01/04/2024, bank CTR and EFT thresholds are ZiG 70,000 for local transactions or USD 5,000 equivalent for foreign-currency transactions; the IFT threshold is USD 5,000 equivalent. Weekly returns, including nil returns, are due on or before the second working day of the week.

Question 13

What threshold report applies to NBFIs and DNFBPs?

Accepted Answer

The same directive sets CTR thresholds at ZiG 70,000 for local transactions or USD 5,000 equivalent for foreign currency. Monthly CTR or nil returns are due on or before the tenth day.

Question 14

How long are AML records kept?

Accepted Answer

Generally at least five years: CDD and relationship records from the relationship end, transaction records from the transaction and STR material from the report. Detached intermediary wire data covered by section 27(8) is kept at least ten years.

Question 15

What happens on a confirmed UN sanctions match?

Accepted Answer

Freeze the covered funds, assets and economic resources without prior notice, immediately and no later than 24 hours; prevent funds or services being made available; and report through goAML immediately and no later than 24 hours. Assess an STR separately.

Question 16

How often should sanctions screening run?

Accepted Answer

Before onboarding or an occasional transaction and daily thereafter under the FIU's 2024 directive. RBZ-regulated institutions also maintain real-time screening for cross-border transactions.

Question 17

Are virtual-asset service providers regulated?

Accepted Answer

Yes. S.I. 99 of 2026 creates FIU registration, fitness, governance, AML, travel-rule, unhosted-wallet and recordkeeping requirements. A certificate is valid for one year unless earlier suspended, surrendered or revoked.

Question 18

When does the VASP travel rule apply?

Accepted Answer

The ordering VASP must obtain and hold prescribed originator and beneficiary information for all virtual-asset transfers and send it securely. CDD applies at USD 1,000 or more, and unhosted-wallet transfers above USD 1,000 require wallet-ownership proof.

Question 19

Must a KYC provider obtain a POTRAZ data-controller licence?

Accepted Answer

A person determining the purposes and means of processing or processing for commercial benefit falls within the 2024 licensing rules unless exempt. Confirm the appropriate licence tier with POTRAZ, appoint a DPO and maintain the required notifications.

Question 20

What is required for biometric KYC?

Accepted Answer

Biometric data generally requires written consent unless a statutory exception applies. Notify POTRAZ of biometric or genetic processing, minimise collection, secure the data and preserve the lawful-condition analysis and consent or exception evidence.

Question 21

How quickly must a personal-data breach be notified?

Accepted Answer

Notify POTRAZ within 24 hours of awareness. If the breach is likely to create high risk for individuals' rights and freedoms, inform those people within 72 hours. The controller also completes the investigation and report within 21 days from notification.

Question 22

Can KYC data be hosted outside Zimbabwe?

Accepted Answer

Only with the section 28 adequacy conditions or a section 29 transfer condition, plus the required POTRAZ notification and any current authorisation. Map every foreign hosting, support and access location before transfer.

Question 23

Is Zimbabwe on the FATF grey list?

Accepted Answer

No, not in the FATF public statements dated 19 June 2026. FATF removed Zimbabwe from increased monitoring in March 2022. Zimbabwe remains in ESAAMLG enhanced follow-up, which is a separate peer-review process.

Download the Zimbabwe KYC, KYB & AML checklist

Get the PDF immediately

Reviewed and source-linked

Verify once. Everywhere.

Download the Zimbabwe KYC, KYB & AML checklist

Get the PDF immediately

Reviewed and source-linked

Verify once. Everywhere.