Orzpay Anti-money Laundering (AML) & Know Your Customer (KYC) Policy
Effective Date: 24th/08/2026
Last Updated: 24th/08/2026
1. Introduction
OrzPay is committed to maintaining a secure, responsible and trustworthy digital payment environment.
We recognize the importance of preventing our services from being misused for money laundering, terrorist financing, fraud, proliferation financing and other financial crimes.
This AML/KYC Policy outlines the general principles and controls OrzPay applies, or intends to apply as applicable to its regulated activities, to identify customers, assess risks, monitor transactions and prevent the misuse of its services.
The policy is intended to operate in accordance with applicable laws and regulatory requirements in Uganda and other jurisdictions in which OrzPay may operate.
Uganda’s Financial Intelligence Authority is responsible for combating money laundering, terrorism financing and proliferation financing, and the Anti-Money Laundering Act establishes obligations for applicable accountable persons.
2. Our AML/CFT Commitment
OrzPay maintains a zero-tolerance approach to the deliberate use of its services for:
- Money laundering
- Terrorist financing
- Fraud
- Proceeds of crime
- Sanctions evasion
- Proliferation financing
- Identity theft
- Other unlawful financial activities
We seek to identify and manage financial crime risks using a risk-based approach.
The controls applied may vary according to the nature of the customer, product, transaction, geographical exposure and associated risk.
3. Know Your Customer (KYC)
KYC procedures help OrzPay establish and verify the identity of customers and understand the nature and purpose of their relationship with our services.
Depending on the product and applicable requirements, customers may be required to provide:
- Full name
- Date of birth
- Telephone number
- Residential or business address
- National identification information
- Identification documents
- Email address
- Source or purpose of funds where required
- Business registration information
- Beneficial ownership information
- Other information reasonably required for verification
Uganda’s AML framework requires applicable entities to identify and verify customers and, where relevant, beneficial owners and the purpose and intended nature of the business relationship.
4. Customer Due Diligence
OrzPay may conduct Customer Due Diligence (CDD) before establishing certain customer relationships or allowing access to particular services.
CDD may include:
- Identifying the customer.
- Verifying customer information.
- Identifying beneficial owners where applicable.
- Understanding the purpose of the relationship.
- Assessing the customer’s risk profile.
- Monitoring activity throughout the relationship.
- Updating customer information when necessary.
Additional verification may be requested when information is incomplete, inconsistent or presents an elevated risk.
5. Risk-Based Approach
OrzPay may categorize customers and transactions according to their level of financial crime risk.
Risk factors may include:
- Customer profile
- Type of service used
- Transaction activity
- Transaction value and frequency
- Geographic exposure
- Business activity
- Source of funds
- Ownership structure
- Unusual transaction patterns
- Sanctions or other regulatory concerns
Higher-risk relationships may be subject to Enhanced Due Diligence (EDD).
Uganda FIA guidance specifically recommends a risk-based approach, with enhanced due diligence for higher-risk customers and ongoing monitoring.
6. Enhanced Due Diligence
Where a customer or transaction presents an elevated risk, OrzPay may request additional information or documentation.
This may include:
- Additional identity documents
- Proof of address
- Source of funds information
- Source of wealth information where appropriate
- Business ownership information
- Nature and purpose of transactions
- Additional verification of beneficial owners
- Additional review of transaction activity
OrzPay may decline, restrict or delay a service where the required due diligence cannot be satisfactorily completed.
7. Politically Exposed Persons (PEPs)
OrzPay may identify and assess customers who qualify as Politically Exposed Persons (PEPs), as well as relevant family members or close associates, in accordance with applicable law.
Where required, enhanced measures may be applied to manage the associated risks.
Being identified as a PEP does not automatically mean that a customer will be refused service.
8. Sanctions and Restricted Persons
OrzPay may conduct appropriate screening against applicable sanctions, watchlists and other relevant regulatory databases.
Where a customer, transaction or beneficiary presents a potential sanctions or legal concern, OrzPay may:
- Request additional information.
- Delay processing.
- Restrict an account or transaction.
- Decline a transaction.
- Take other measures required by applicable law.
9. Transaction Monitoring
OrzPay may monitor customer and transaction activity to identify unusual or potentially suspicious patterns.
Monitoring may consider:
- Unusual transaction volumes
- Rapid movement of funds
- Multiple transactions designed to avoid controls
- Transactions inconsistent with a customer’s profile
- Unusual geographic activity
- Suspicious payment patterns
- Potential fraud indicators
- Other activity that may require investigation
Monitoring does not necessarily mean that a customer has done anything wrong. Transactions may be reviewed to help OrzPay meet its legal, regulatory and risk-management responsibilities.
10. Suspicious Transactions
Where OrzPay identifies activity that may be suspicious or unlawful, it may conduct an internal review and take appropriate action.
Where legally required, relevant information may be reported to the appropriate regulatory or law-enforcement authorities.
The Financial Intelligence Authority receives Suspicious Transaction Reports (STRs) from applicable accountable persons in Uganda.
OrzPay will not normally disclose the existence or details of a suspicious transaction report where disclosure is prohibited by law.
11. Prohibited Activities
Customers must not use OrzPay services for illegal activities.
Prohibited activities may include:
- Money laundering
- Terrorist financing
- Fraud
- Theft
- Sanctions evasion
- Financing criminal activity
- Identity fraud
- Transactions involving unlawful proceeds
- Any activity prohibited by applicable law
OrzPay may suspend, restrict or terminate accounts associated with prohibited or suspicious activities, subject to applicable law and contractual obligations.
12. Source of Funds
Where appropriate and permitted by law, OrzPay may request information regarding the source or purpose of funds.
Customers may be required to provide reasonable supporting information where transaction activity presents elevated risk or where required for regulatory compliance.
13. Beneficial Ownership
For businesses, companies and other legal entities, OrzPay may require information regarding:
- Legal ownership
- Beneficial ownership
- Directors
- Authorized representatives
- Persons exercising control
- Business activities
This helps OrzPay understand who ultimately owns or controls a business relationship.
14. Record Keeping
OrzPay maintains appropriate records relating to customer identification, transactions, due diligence and compliance activities in accordance with applicable legal and regulatory requirements.
Uganda FIA guidance states that applicable accountable persons should maintain AML-related records for the required statutory period, including a minimum ten-year record-keeping period identified in its compliance guidance.
15. Customer Information Updates
Customers may be required to update their information from time to time.
This may occur where:
- Identification documents expire.
- Customer information changes.
- Business ownership changes.
- Transaction activity changes significantly.
- Additional verification is required.
- Applicable laws or regulations change.
Failure to provide requested information may result in restrictions on certain services.
16. AML/CFT Training
OrzPay seeks to ensure that relevant employees and personnel understand their responsibilities regarding:
- AML/CFT requirements
- KYC procedures
- Fraud prevention
- Customer due diligence
- Suspicious transaction identification
- Sanctions and risk controls
- Data confidentiality
The FIA identifies ongoing employee training and an independent audit function among the elements of an effective AML compliance programme.
17. Compliance Responsibility
OrzPay will maintain appropriate internal responsibilities and controls for managing AML/CFT risks.
Depending on the nature and regulatory status of the business, these may include:
- Compliance oversight
- AML/CFT procedures
- Customer due diligence procedures
- Transaction monitoring
- Risk assessments
- Record keeping
- Regulatory reporting
- Employee training
- Periodic review and testing of controls
Where legally required, OrzPay will appoint or designate the appropriate compliance personnel.
18. Third-Party and Partner Relationships
OrzPay may work with banks, mobile network operators, payment processors, technology providers and other partners.
Where appropriate, OrzPay may conduct due diligence and risk assessments relating to relevant business relationships.
Partners may be required to maintain appropriate compliance, security and financial crime controls.
19. Data Protection and Confidentiality
Information collected for KYC, AML and compliance purposes will be handled in accordance with applicable data protection and privacy requirements.
OrzPay will seek to protect customer information from unauthorized access, use or disclosure.
Uganda’s Personal Data Protection Office requires organizations handling personal data to establish appropriate privacy governance, security and breach-management practices.
20. Cooperation With Authorities
OrzPay may cooperate with competent regulatory, law-enforcement and government authorities where required or permitted by applicable law.
This may include responding to lawful requests for information and submitting required regulatory reports.
21. Policy Review
OrzPay will periodically review this AML/KYC Policy to ensure that it remains appropriate for its services, risk profile, technology and applicable legal and regulatory requirements.
The policy may be updated when laws, regulations, regulatory guidance, products or business activities change.
Uganda’s FIA currently publishes AML laws, regulations and amendments, including the Anti-Money Laundering Amendment Regulations, so the policy should be reviewed against the latest applicable requirements before final publication.
22. Contact Us
For questions regarding OrzPay’s AML/KYC requirements, please contact:
OrzPay
Plot 793 Rubaga Road
P.O. Box 3131
Kampala, Uganda
Email: info@orzpay.com