Uganda -- AML/CFT Compliance Regulatory Overview

Uganda's Anti-Money Laundering Act, 2013 (Act 12 of 2013), consolidated as Chapter 118, imposes its obligations on accountable persons, defined as any person listed in its Second Schedule, and section 18 establishes the Financial Intelligence Authority; the Act reaches virtual asset service providers by express designation rather than by interpretation, because the Anti-Money Laundering (Amendment of Second Schedule) Instrument, 2020 (Statutory Instrument 136 of 2020) added virtual asset service providers to that Schedule with effect from 27 November 2020, and they stand as paragraph 16 of Schedule 2 in the Financial Intelligence Authority's signed registration guidelines of January 2024, which require every accountable person to register with the Authority.

Uganda's Anti-Money Laundering Regulations, 2015 are Statutory Instrument 75 of 2015, made on 24 December 2015 under the Anti-Money Laundering Act, 2013, and they do carry the implementing detail the claim describes: Part V, regulations 13 to 27, sets out customer due diligence and verification for natural persons, foreign nationals, entities, partnerships and trustees; regulation 42 requires an accountable person to keep transaction and due-diligence records for a minimum of five years from completion of the relevant business or transaction; and regulation 39 governs suspicious transaction reporting to the Financial Intelligence Authority, with regulation 39(3) additionally requiring reports of cash transactions above one thousand currency points.

Uganda has no Financial Intelligence Authority Act, of 2013 or of any year; the Uganda Legal Information Institute's consolidated index of legislation carries no such title. The Financial Intelligence Authority is established by section 18 of the Anti-Money Laundering Act, 2013 (Act 12 of 2013), Chapter 118, which reads 'There is established a Financial Intelligence Authority', and the Authority's functions of receiving, analysing and disseminating financial intelligence flow from that Act rather than from a separate statute.

The Bank of Uganda Act is Chapter 54 under Uganda's current revision, Chapter 51 having been its number only in the Revised Edition of 2000; the Act originates as Statute 5 of 1993, commenced 14 May 1993, and its text contains no provision on virtual assets, cryptocurrency, digital currency or blockchain. The Bank of Uganda's operative virtual-asset instrument is not the Bank of Uganda Act but its circular to National Payment Systems licensees of 29 April 2022, issued under sections 13(1)(b) and (f) of the National Payment Systems Act, 2020, which states that the Bank has licensed no institution to sell or facilitate trade in cryptocurrencies and directs licensees to desist from facilitating cryptocurrency transactions.

Individual Customers: Obtain and verify the customer's full name, permanent address, date of birth, national identification number (e.g., National ID, passport), and other relevant identification documents.

Legal Entities (Companies, etc.): Obtain and verify the company's registered name, legal form, proof of incorporation, physical address, business registration number, tax identification number, and details of directors, beneficial owners, and authorized signatories.

Beneficial Ownership: Identify and verify the identity of the beneficial owner(s) – the natural person(s) who ultimately own or control the customer, or the natural person(s) on whose behalf a transaction is being conducted.

Purpose and Intended Nature of Business Relationship: Understand the purpose and intended nature of the business relationship or the transaction.

Ongoing Monitoring: Continuously monitor the business relationship and transactions undertaken by the customer to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile, including the source of funds where necessary.

Enhanced Due Diligence (EDD): Apply EDD for higher-risk customers, transactions, or business relationships. This includes:

Customers from high-risk jurisdictions (identified by FATF or local authorities)

Transactions involving large amounts or complex structures

Transactions with no apparent economic or lawful purpose.

Simplified Due Diligence (SDD): May be applied in limited circumstances where the risk of money laundering or terrorist financing is lower, as permitted by the regulations.

Report Suspicious Transactions: Report any transaction (attempted or completed) where there is a reasonable suspicion that the funds involved are proceeds of crime, or are linked to money laundering, terrorist financing, or proliferation financing.

Regulation 39 of Uganda's Anti-Money Laundering Regulations, 2015 (Statutory Instrument 75 of 2015) requires an accountable person to report a suspicious transaction to the Financial Intelligence Authority as soon as is practicable and in any case not later than forty-eight hours, on the prescribed form, while section 9(2) of the Anti-Money Laundering Act, 2013 sets the statutory limit as without delay and not later than two working days from the date the suspicion was formed, so the forty-eight-hour figure is the regulation's and the two-working-day figure is the Act's.

No Tipping-Off: Not disclose to the customer or any third party that a suspicious transaction report has been made or that a money laundering investigation is being conducted.

Customer Identification Records: All records obtained during CDD processes (identification documents, verification records, beneficial ownership information).

Transaction Records: Records of all domestic and international transactions, including the amount, currency, date, type of transaction, and parties involved. For virtual assets, this would include wallet addresses, transaction hashes, and amounts.

Section 7(2)(a) of Uganda's Anti-Money Laundering Act 2013 requires an accountable person to keep account files and business correspondence, including the results of any analysis undertaken and copies of documents evidencing the identities of customers and beneficial owners.

Uganda's Anti-Money Laundering Act 2013 s. 7(3) requires records to be kept for a minimum period of ten years from the date on which the evidence of identity of a person was obtained, the date of any transaction or correspondence, or the date on which the account is closed or the business relationship ceases, whichever is the later.

Bank of Uganda Circular on Virtual Currencies (2022): While a direct URL for a circular may be ephemeral, the BOU regularly publishes such statements. A general search for "Bank of Uganda virtual currency statement" often yields news articles or official press releases reflecting this stance. For example, a common reference point is the Bank of Uganda Governor's statements regarding financial innovation and risks.

Virtual asset service providers are accountable persons under Uganda's Anti-Money Laundering Act 2013: Statutory Instrument 136 of 2020, effective 27 November 2020, amended the Second Schedule to add them, they appear as paragraph 16 of Schedule 2 in the FIA's signed January 2024 registration guidelines, and they must register with the Financial Intelligence Authority.

Legal Reference: The Anti-Money Laundering Act, 2013 (as amended) (PDF hosted by FIA)

Uganda's Anti-Terrorism Act, 2002 is Act 14 of 2002, assented on 21 May 2002 and commenced on 7 June 2002 and amended in 2015, 2016 and 2017; Part V criminalises financial assistance for terrorism, and the Anti-Terrorism Regulations 2025 made under it implement United Nations Security Council targeted financial sanctions in Uganda.

Legal Reference: A specific, easily accessible online version of the amended Act can be hard to pinpoint. Often, legal databases or government gazettes are the source. A general search for "Uganda Anti-Terrorism Act" will point to its existence.

Uganda's Financial Intelligence Authority receives suspicious transaction reports from accountable persons under s. 9(1) of the Anti-Money Laundering Act 2013 and issues guidelines to them, including the signed Online Registration Guidelines for Accountable Persons of January 2024 that require registration with the Authority.

Reference: Financial Intelligence Authority (FIA) Uganda Website

Uganda implements United Nations Security Council targeted financial sanctions through the Anti-Terrorism Regulations 2025 made under the Anti-Terrorism Act 2002, under which the Financial Intelligence Authority circulates designations to accountable persons within four hours and freezing is required without delay, without prior notice to the designated party, and within twenty-four hours.

Ugandan virtual asset service providers must screen customers and transactions against United Nations designations and freeze the funds of designated persons because SI 136 of 2020 made them accountable persons at paragraph 16 of Schedule 2 to the Anti-Money Laundering Act 2013, and the Anti-Terrorism Regulations 2025 impose the freezing and dealing prohibition on accountable persons.

Legal Reference: United Nations Security Council Sanctions Committees

OFAC Sanctions (U.S. Department of the Treasury's Office of Foreign Assets Control):

Extraterritorial Reach: OFAC sanctions have significant extraterritorial reach. Any VASP that uses US dollar clearing, has US customers, servers, or any operational nexus with the US, is directly subject to OFAC regulations, regardless of where they are incorporated. This effectively includes most globally connected VASPs.

Ugandan virtual asset service providers must screen customers and transactions against United Nations designations and freeze the funds of designated persons because SI 136 of 2020 made them accountable persons at paragraph 16 of Schedule 2 to the Anti-Money Laundering Act 2013, and the Anti-Terrorism Regulations 2025 impose the freezing and dealing prohibition on accountable persons.

Legal Reference: OFAC's Sanctions Programs and Country Information

Guidance on Virtual Currency: OFAC has issued specific guidance on applying sanctions to virtual currency, emphasizing that its regulations apply to virtual currency just as they do to traditional fiat currency.

Legal Reference: OFAC's A Framework for OFAC Compliance Commitments (2019) (PDF, refers to virtual currency obligations) and various FAQs.

Jurisdictional Reach: EU sanctions apply to all EU nationals and entities, regardless of where they operate, and to non-EU entities conducting business within the EU. Given global financial interconnectivity, VASPs with any European nexus (customers, partners, funding) must comply.

Ugandan virtual asset service providers must screen customers and transactions against United Nations designations and freeze the funds of designated persons because SI 136 of 2020 made them accountable persons at paragraph 16 of Schedule 2 to the Anti-Money Laundering Act 2013, and the Anti-Terrorism Regulations 2025 impose the freezing and dealing prohibition on accountable persons.

Legal Reference: EU Financial Sanctions Map

Implement Robust KYC/CDD: Conduct thorough Know Your Customer (KYC) and Customer Due Diligence (CDD) procedures to identify all parties involved in a transaction.

Screen Against Sanctions Lists: Regularly screen all customers, beneficial owners, and transaction counterparties against:

OFAC's SDN List and other relevant OFAC lists.

Geographic Screening: Identify and flag transactions involving high-risk or sanctioned jurisdictions.

Transaction Monitoring: Implement systems to monitor transactions for patterns indicative of sanctions evasion or illicit activity (e.g., unusual transaction sizes, rapid movements of funds to high-risk areas).

An accountable person in Uganda must report a suspicious transaction to the Financial Intelligence Authority under s. 9(1) of the Anti-Money Laundering Act 2013 regardless of the value of the transaction, without delay and not later than two working days from the date the suspicion was formed, and s. 9(6) bars disclosing to the customer or any other person that a report has been or will be made.

Sanctioned Countries: Countries comprehensively sanctioned by the UN, OFAC (e.g., Cuba, Iran, North Korea, Syria), or the EU.

High-Risk Jurisdictions: Jurisdictions identified by FATF or other bodies as having strategic AML/CTF deficiencies.

Under the Anti-Money Laundering Act, 2013:

Uganda's Anti-Money Laundering Act, 2013 (Act 12 of 2013) provides for search and seizure of tainted property (sections 61, 66 and 67), restraining orders (sections 71 to 82) and confiscation on conviction (sections 83 and 86), and its interpretation section defines property as assets of every kind whether corporeal or incorporeal, wide enough to reach virtual assets, while the Act itself creates no virtual-asset category and no virtual-asset freezing power.

Under the Anti-Terrorism Act, 2002:

Even harsher penalties, including lengthy imprisonment, apply for financing terrorism.

International Penalties: Non-compliance with OFAC or EU sanctions can lead to massive fines (billions of USD/EUR), criminal charges, and exclusion from international financial systems, regardless of the VASP's Ugandan operations.