Anti-Money Laundering and Counter-Terrorism Financing Policy

The short version

This policy exists because Payleo takes financial crime seriously. Here is what it means in practice.

We are required by law to fight financial crime. As a microfinance service provider operating in Tanzania, Payleo must comply with the Anti-Money Laundering Act (Cap. 423), the Prevention of Terrorism Act (Cap. 19), and the Microfinance Act, 2018 — including their respective regulations and guidelines issued by the Bank of Tanzania and the Financial Intelligence Unit.
We verify who you are before you can use our services. Every user — whether an individual employee, an organisation, or an agent — goes through a Know Your Customer (KYC) or Know Your Business (KYB) process before accessing credit or transacting on the platform.
We monitor transactions continuously. Our systems flag unusual or suspicious activity. When warranted, we report to the Financial Intelligence Unit (FIU) as required by law.
We never tip off. If your account or transaction is under review, we are legally prohibited from telling you. This is not a choice — it is the law.
Every employee is trained. All Payleo staff receive AML/CTF training and certify annually that they understand their obligations.
Records are kept for at least seven years. Transaction records, identification documents, and suspicious activity reports are retained in accordance with regulatory requirements.

1. Introduction

Payleo Financial Service Limited (“Payleo,” “the Company”) is a microfinance service provider offering credit services and wage advances to employees of registered organisations in the United Republic of Tanzania.

Payleo recognises that financial service providers have a critical role in preventing criminals and terrorists from exploiting the financial system. The convergence of financial services with digital and mobile technology — while expanding financial access to underserved populations — also creates risks that must be actively managed.

This policy establishes the principles, procedures, and controls that Payleo maintains to prevent, detect, and report money laundering, terrorism financing, and proliferation financing through its platform and operations.

2. Legal and regulatory framework

This policy is grounded in and must be read in conjunction with the following Tanzanian legislation and international standards:

2.1 Primary legislation

Law	Relevance
Anti-Money Laundering Act (Cap. 423, R.E. 2022)	Primary AML legislation. Establishes the Financial Intelligence Unit (FIU), defines money laundering offences, imposes customer due diligence (CDD) obligations on reporting persons, and mandates suspicious transaction reporting.
Anti-Money Laundering Regulations, 2022 (GN. No. 397)	Subsidiary regulations under Cap. 423. Prescribe risk assessment obligations, CDD procedures, record-keeping standards, and the electronic funds transfer and cash transaction reporting framework.
Prevention of Terrorism Act (Cap. 19)	Criminalises terrorism and terrorist financing. Section 13 prohibits the provision or collection of funds for terrorist acts. Section 14 prohibits the provision of property or financial services for the commission of terrorist acts.
Prevention of Terrorism (General) Regulations, 2022 (GN. No. 379)	Prescribe targeted financial sanctions procedures and the obligations of financial institutions in relation to terrorism financing.
Microfinance Act, 2018 (No. 10 of 2018)	Governs licensing, regulation, and supervision of microfinance business. Section 49 requires microfinance service providers to establish internal control procedures for identifying and reporting suspicious transactions in compliance with Cap. 423. Section 43 mandates the sharing of credit information with credit reference bureaus.
Proceeds of Crime Act (Cap. 256)	Provides for confiscation and forfeiture of assets obtained from criminal activity.

2.2 Regulatory guidance

Payleo also adheres to guidelines and circulars issued by the Bank of Tanzania and the Financial Intelligence Unit, including guidelines on targeted financial sanctions, risk-based supervision, and the conduct of customer due diligence.

2.3 International standards

This policy is aligned with the recommendations of the Financial Action Task Force (FATF), including the FATF Guidance on Anti-Money Laundering and Terrorist Financing Measures and Financial Inclusion, and the standards of the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), of which Tanzania is a member.

3. Scope

This policy applies to:

All Payleo products and services, including wage advances, credit services, and any related digital or USSD-based offerings.
All Payleo employees, directors, officers, and contractors, regardless of role or seniority.
All organisations and individuals onboarded onto the Payleo platform, including business owners, authorised representatives, and employees.
All third-party agents, partners, or service providers engaged by Payleo in the delivery of its services.

This policy must be read in conjunction with all other relevant Payleo policies, including the Privacy Policy and the Terms of Service.

4. Definitions

AML — Anti-Money Laundering.

CTF — Counter-Terrorism Financing.

CPF — Counter-Proliferation Financing.

CDD — Customer Due Diligence. The process of verifying the identity of a customer and assessing the risk they present.

EDD — Enhanced Due Diligence. Additional verification measures applied to higher-risk customers, transactions, or relationships.

FIU — The Financial Intelligence Unit of the United Republic of Tanzania, established under Part II of the Anti-Money Laundering Act (Cap. 423).

KYC — Know Your Customer. The set of controls and standards surrounding the identification of individual users and the parameterisation of their expected transaction activity.

KYB — Know Your Business. The set of controls and standards surrounding the identification of organisations and agents acting on behalf of or through the Payleo platform.

MLRO — Money Laundering Reporting Officer. The officer appointed by Payleo with primary responsibility for overseeing AML/CTF/CPF compliance.

Money laundering — As defined by Cap. 423: the engagement of a person, directly or indirectly, in the conversion, transfer, concealment, disguising, use, or acquisition of money or property known to be of illicit origin, with the intent to avoid the legal consequences of such action. Includes the offences referred to in Section 12 of Cap. 423.

PEP — Politically Exposed Person. A foreign or domestic individual entrusted with a prominent public function, as defined by Cap. 423 and applicable FATF guidance.

Reporting person — As defined by Cap. 423: any person or institution required to comply with AML/CTF obligations, including microfinance service providers.

STR — Suspicious Transaction Report. A report filed with the FIU when there are reasonable grounds to suspect that a transaction or attempted transaction is related to money laundering, terrorism financing, or proliferation financing.

Terrorism financing — As defined by Cap. 19: the provision or collection of funds, by any means, directly or indirectly, with the intention or knowledge that the funds will be used to carry out a terrorist act, or the provision of property or financial services for terrorist purposes.

5. Governance and oversight

5.1 Board of Directors

The Board of Directors bears ultimate accountability for the effectiveness of Payleo’s AML/CTF/CPF programme. The Board approves this policy, ensures adequate resources are allocated to its implementation, and receives periodic reports on the Company’s compliance posture.

5.2 Money Laundering Reporting Officer (MLRO)

The Board shall appoint a Money Laundering Reporting Officer who shall be a senior officer of the Company with the authority, independence, and resources to perform the role effectively.

The MLRO is responsible for:

Overseeing the implementation and day-to-day management of this policy across all Payleo operations.
Receiving, evaluating, and determining the appropriate action for all internal suspicious activity reports raised by staff.
Filing Suspicious Transaction Reports (STRs) and any other mandatory reports with the Financial Intelligence Unit within the timeframes prescribed by law — in particular, within twenty-four (24) hours of forming a suspicion, and wherever possible before any transaction is carried out, as required by Cap. 423.
Filing Currency Transaction Reports (CTRs) and Electronic Funds Transfer reports as prescribed by the Anti-Money Laundering (Electronic Funds Transfer and Cash Transaction Reporting) Regulations, 2019.
Maintaining ongoing communication with the FIU, the Bank of Tanzania, and any other relevant regulatory authority.
Reporting to the Board on a quarterly basis, at minimum, on the status of AML/CTF/CPF compliance, including a summary of monitoring activity, STRs filed, training conducted, and any identified deficiencies or remedial actions.
Ensuring that all AML/CTF/CPF records are maintained in accordance with the retention periods prescribed by law and this policy.
Coordinating with internal functions — including Legal, Finance, Technology, and Human Resources — as necessary to investigate alerts and suspicious activity.

5.3 AML Committee

The MLRO may be supported by an AML Committee, the composition of which shall be determined by the Board or the Risk Committee. The AML Committee provides management-level guidance on AML/CTF/CPF matters and assists the MLRO in evaluating complex cases.

6. Risk assessment

6.1 Institutional risk assessment

In accordance with Section 15 of Cap. 423 and Regulation 3 of the Anti-Money Laundering Regulations, 2022, Payleo shall conduct a money laundering, terrorism financing, and proliferation financing risk assessment at the institutional level. This assessment shall:

Identify and evaluate the ML/TF/PF risks specific to Payleo’s products, services, delivery channels, customer types, and geographic exposure.
Be documented and made available to the Bank of Tanzania, the FIU, or any other competent authority upon request.
Be reviewed and updated at least annually, or more frequently when there is a material change in the Company’s risk profile, product offerings, or regulatory environment.

6.2 Risk-based approach

Payleo adopts a risk-based approach to AML/CTF/CPF compliance, as required by Cap. 423 and the FATF recommendations. This means that resources and controls are allocated proportionately to the level of risk identified, with higher-risk customers, products, and transactions subject to enhanced scrutiny.

7. Customer due diligence (CDD)

7.1 When CDD must be performed

Payleo shall conduct CDD:

Before establishing a business relationship with any customer — whether an individual employee, an organisation, or an authorised representative.
Before carrying out any transaction for a customer who is not in an ongoing business relationship with Payleo.
When there is a suspicion of money laundering or terrorism financing, regardless of any exemption or threshold that might otherwise apply.
When there are doubts about the veracity or adequacy of previously obtained customer identification data.

7.2 Minimum standards for individual identification (KYC)

All individual users of the Payleo platform — including employees accessing wage-advance services — must present valid identification documentation as prescribed by Tanzanian law. Acceptable documents include:

A valid National Identity Card (NIDA).
A valid passport.
A valid driver’s licence.
Any other document accepted by the MLRO in accordance with applicable law and regulation.

In addition, the following information shall be captured during registration: full legal name, date of birth, gender, nationality, physical address, occupation and employment details, mobile phone number associated with the Payleo account, and salary information (where relevant to the credit service being offered).

7.3 Minimum standards for organisation identification (KYB)

All organisations onboarded onto the Payleo platform must provide:

A valid certificate of incorporation or registration issued under applicable Tanzanian law.
The Tax Identification Number (TIN) of the organisation.
Identification of the beneficial owners — that is, the natural persons who ultimately own or control the organisation, or on whose behalf a transaction is being conducted.
Identification and verification of the authorised representative(s) who will operate the organisation’s account on the management portal, using the individual KYC standards described in Section 7.2 above.
Business registration documentation, nature of business, and source of funds.

7.4 Ongoing due diligence

CDD does not end at onboarding. Payleo shall conduct ongoing due diligence throughout the customer relationship, including:

Monitoring transactions to ensure they are consistent with the customer’s known risk profile, business activity, and source of funds.
Keeping customer identification data and records up to date by requiring periodic review and re-verification, particularly when there is a change in the customer’s circumstances or risk profile.
Applying additional scrutiny to transactions or patterns of activity that are unusual, unexpected, or inconsistent with the customer’s profile.

7.5 Enhanced due diligence (EDD)

EDD measures shall be applied to customers, transactions, or relationships that present a higher risk of money laundering or terrorism financing, including but not limited to:

Politically Exposed Persons (PEPs): both foreign and domestic PEPs, their family members, and close associates. EDD for PEPs includes establishing the source of wealth and source of funds, and obtaining senior management approval before establishing or continuing the relationship.
High-risk jurisdictions: customers or transactions involving countries identified by the FATF, the FIU, or the Bank of Tanzania as presenting a higher ML/TF risk.
Complex or unusual transaction patterns: transactions that have no apparent economic or lawful purpose, or that are unusually large or complex relative to the customer’s profile.
Customers who cannot be physically present for identification: additional measures shall be taken to verify identity through independent and reliable sources.

7.6 Simplified due diligence

Where the institutional risk assessment and the specific risk assessment of a customer or product type indicate a demonstrably lower risk, Payleo may apply simplified due diligence measures, provided this is permitted by the applicable regulations and approved by the MLRO. Simplified due diligence does not exempt the Company from the obligation to monitor transactions or report suspicious activity.

8. Sanctions screening and watch-list checks

8.1 Obligation to screen

As an integral part of its AML/CTF/CPF controls, Payleo shall screen all customers, organisations, beneficial owners, authorised representatives, agents, employees, and contractors against relevant sanctions and watch lists at the following points:

At the onset of the relationship (during onboarding or appointment).
On an ongoing basis, including whenever a sanctions list is updated.
When a suspicion arises or when triggered by a monitoring alert.

8.2 Lists to be screened

At a minimum, screening shall be conducted against:

United Nations Security Council Consolidated List — including the ISIL (Da’esh) and Al-Qaida Sanctions List (UNSCR 1267/1989/2253), the Taliban Sanctions List (UNSCR 1988), and the non-proliferation lists (UNSCR 1718 and 2231).
Tanzania domestic designations — including lists of persons designated as suspected domestic terrorists under Section 12A of the Prevention of Terrorism Act (Cap. 19), and any designations published by the FIU or the Minister for Home Affairs.
Targeted Financial Sanctions lists as prescribed by the FIU’s Guidelines on Targeted Financial Sanctions.
Politically Exposed Person (PEP) databases.
Any additional lists required by the Bank of Tanzania, the FIU, or other competent authorities from time to time.

8.3 Handling positive matches

Any positive or potential match must be immediately escalated to the MLRO for investigation. Confirmed matches shall be reported to the FIU and relevant law enforcement authorities in accordance with Cap. 423, Cap. 19, and the applicable targeted financial sanctions regulations. Payleo shall freeze or withhold any funds or transactions associated with a confirmed match, as directed by the FIU or a court order.

9. Transaction monitoring and suspicious activity

9.1 Continuous monitoring

Payleo shall maintain systems and procedures for the continuous monitoring of customer transactions and activity on the platform. Monitoring shall be designed to detect:

Transactions that are unusual, unexpectedly large, or inconsistent with the customer’s known profile, history, or stated purpose.
Patterns of activity that may indicate structuring, layering, or other money laundering techniques.
Rapid or unusual movement of funds through multiple accounts or channels.
Transactions involving high-risk jurisdictions, PEPs, or sanctioned persons.
Any other indicators of money laundering, terrorism financing, or proliferation financing as identified in FIU guidance, FATF typologies, or Payleo’s own risk assessment.

9.2 Reporting suspicious transactions

Under Section 17 of Cap. 423, when any Payleo staff member forms a suspicion — with or without firm evidence — that a transaction or attempted transaction may be related to money laundering, terrorism financing, or proliferation financing, they must immediately report it internally to the MLRO.

The MLRO shall evaluate the internal report and, where the suspicion is maintained, file a Suspicious Transaction Report (STR) with the Financial Intelligence Unit within twenty-four (24) hours of forming the suspicion, and wherever possible before the transaction is carried out.

9.3 Prohibition of tipping off

Under no circumstances shall any Payleo staff member, director, officer, agent, or contractor disclose to the subject of a suspicious activity report — or to any other person — that a report has been filed or that an investigation is underway. Tipping off is a criminal offence under Cap. 423 and may result in administrative sanctions, criminal prosecution, and termination of employment.

This prohibition applies regardless of whether the suspicion ultimately proves to be well-founded.

9.4 Threshold reporting

Payleo shall comply with any threshold reporting requirements prescribed by the Anti-Money Laundering (Electronic Funds Transfer and Cash Transaction Reporting) Regulations, 2019, and any other applicable regulations or FIU directives.

10. Record keeping

10.1 Obligation

In accordance with Cap. 423, the Microfinance Act 2018 (Section 38), and the Anti-Money Laundering Regulations, 2022, Payleo shall maintain comprehensive records of:

All customer identification and verification documents collected during the CDD process.
All transaction records, including the nature, date, time, amount, currency, and parties involved.
All internal suspicious activity reports and the MLRO’s evaluation and determination for each.
All STRs and other regulatory reports filed with the FIU.
All correspondence with the FIU, the Bank of Tanzania, or other regulatory or law enforcement authorities.
All AML/CTF/CPF training records, including materials, attendance lists, and assessment results.
All sanctions screening results and the resolution of any positive or potential matches.

10.2 Retention period

Records shall be retained for a minimum of seven (7) years from the date the business relationship ends or the date of the transaction, whichever is later. Where a specific regulation requires a longer retention period, the regulatory period shall take precedence.

Records relating to an investigation, a filed STR, or a matter subject to legal proceedings shall be retained until the matter is fully resolved and for any further period required by the FIU, a court, or other competent authority.

10.3 Format and security

Records may be maintained in hard copy or electronic form, provided they are stored securely, protected against unauthorised access, tampering, or destruction, and are retrievable in a timely manner upon request by the FIU, the Bank of Tanzania, law enforcement, internal audit, or external auditors.

11. Training and awareness

11.1 Obligation

All Payleo staff — including directors, officers, employees, and contractors — shall receive AML/CTF/CPF training commensurate with their role and responsibilities.

11.2 Training content

Training for all staff shall cover, at a minimum:

The legal framework governing AML/CTF/CPF in Tanzania, including Cap. 423, Cap. 19, and the Microfinance Act, 2018.
The definition and indicators of money laundering, terrorism financing, and proliferation financing.
Payleo’s obligations as a reporting person and microfinance service provider.
The contents and requirements of this policy.
CDD and KYC/KYB procedures, including identification requirements and red flags.
How to recognise suspicious activity and transactions.
How and to whom to report suspicions internally (the MLRO).
The prohibition on tipping off and the consequences of non-compliance.
Sanctions screening obligations and procedures.
Record-keeping requirements.
Disciplinary consequences for non-compliance, which may include termination of employment and referral to law enforcement authorities.

11.3 Training for agents and third parties

Where Payleo engages agents or third-party service providers who interact with customers or handle transactions, those agents or third parties shall receive AML/CTF training before they are activated and at regular intervals thereafter. Training shall cover the same core topics as staff training, with additional emphasis on KYC requirements at the point of customer interaction and the escalation of suspicious activity.

11.4 Frequency

Training shall be provided upon commencement of employment or engagement, and refreshed at least annually thereafter. Additional training shall be provided when there are material changes to legislation, regulations, or Payleo’s internal procedures.

11.5 Certification

All staff shall certify annually that they have read, understood, and will comply with this policy. A certification form is provided in Annex A.

11.6 Training records

Training records — including materials, attendance lists, and assessment results — shall be retained for a minimum of seven (7) years from the date of training, in hard copy or electronic form, in a secure environment.

12. Compliance with the Microfinance Act, 2018

12.1 Internal control procedures (Section 49)

In accordance with Section 49 of the Microfinance Act, 2018, Payleo shall establish and maintain internal control procedures for the purpose of identifying and reporting suspicious transactions. The Bank of Tanzania or any Delegated Authority shall have the right to ensure that Payleo operates in compliance with these procedures.

In accordance with Section 43 of the Microfinance Act, 2018, Payleo shall share credit information — including personal information, credit history, paying habits, outstanding debts, and relevant business details — with a credit reference bureau as required by the Bank of Tanzania. Access to and use of credit information through a credit reference bureau shall be conducted in the manner prescribed by the applicable regulations.

12.3 Books of accounts and records (Section 38)

Payleo shall keep proper books of accounts and records sufficient to show and explain its transactions and financial position, as required by Section 38 of the Microfinance Act, 2018. These records form part of the AML/CTF record-keeping framework and must be available for inspection by the Bank of Tanzania or any authorised officer.

12.4 Consumer protection (Section 50)

Payleo’s AML/CTF controls are implemented in a manner that is consistent with the consumer protection principles set out in Section 50 of the Microfinance Act, 2018, including transparency, fair treatment, and the safeguarding of customer interests. AML/CTF procedures shall not be used as a pretext for unfair or discriminatory treatment of any customer.

13. Penalties for non-compliance

Non-compliance with AML/CTF/CPF obligations carries severe consequences under Tanzanian law:

Under Cap. 423, a reporting person who fails to comply with CDD, record-keeping, or suspicious transaction reporting obligations may face administrative sanctions imposed by the FIU or the Bank of Tanzania, and criminal prosecution carrying fines and imprisonment.
Under the Microfinance Act, 2018, a microfinance service provider that contravenes its provisions may, in accordance with Section 52, face fines and imprisonment — ranging from one million to twenty million shillings and three months to five years imprisonment, depending on the tier classification.
Under Cap. 19, providing or collecting funds for terrorist acts is punishable by imprisonment of not less than fifteen years and not more than twenty years.

Internally, any Payleo staff member who fails to comply with this policy, including the failure to report suspicious activity, tipping off, or neglecting CDD obligations, shall be subject to disciplinary action up to and including termination of employment and referral to the relevant authorities.

14. Independent review and audit

Payleo’s AML/CTF/CPF programme shall be subject to independent review and audit, conducted at least annually, to assess the effectiveness of its policies, procedures, and controls. The findings of the review shall be reported to the Board of Directors and any deficiencies shall be addressed through a documented remediation plan with clear timelines and accountability.

The Bank of Tanzania, the FIU, and any other competent authority retain the right to inspect Payleo’s AML/CTF/CPF programme at any time, in accordance with Sections 45 and 47 of the Microfinance Act, 2018 and the applicable provisions of Cap. 423.

15. Policy review and amendments

This policy shall be reviewed at least annually and updated as necessary to reflect changes in legislation, regulations, regulatory guidance, Payleo’s risk profile, or the Company’s products and services.

All amendments to this policy require written approval from the Board of Directors and must be documented with the version number and effective date. Material amendments shall be communicated to all staff, and additional training shall be provided where necessary.

16. Contact

Money Laundering Reporting Officer: [Name to be inserted] Email: compliance@payleo.tz

General inquiries: Email: support@payleo.tz

Payleo Financial Service Limited Dar es Salaam, United Republic of Tanzania