Automate BoZ, FIC and NATC compliance end to end
Ontech PSP Compliance watches wallet and agent activity against BoZ limits and FIC rules, keeps sanctions lists current, drafts goAML reports from closed cases and chases every filing before it falls due. Your compliance team reviews and decides; the platform does the rest.
The obligations differ by licence; the platform switches on the ones that apply to yours.
Wallet limits checked per transaction by hand; agent activity reviewed after the fact
With PSP Compliance: KYC-tier limits across every wallet a customer holds, agent structuring and rapid cash-out rules, trust-account and unclaimed-funds duties on the calendar
Tier 1 & 2 limitsCross-border transfers with missing originator details caught at audit, not at the time
With PSP Compliance: Wire-information checks from USD 1,000, sanctions screening of every counterparty, high-risk-country rules kept to the latest FATF plenary
FIC SI 53/2022Returns to the DFS portal tracked in spreadsheets; a late one costs K500 a day
With PSP Compliance: Every daily, monthly and quarterly return on one calendar with reminders and escalation, figures assembled for the BoZ return
DFS portal returnsIncident and outage notifications to BoZ and ZECHL depend on someone remembering
With PSP Compliance: Event-driven filings with their own clocks, operational-risk register and business-continuity obligations mapped
NFS & ZECHL rulesSix jobs the platform does on its own, every day. People step in only where a decision is needed.
Every BoZ, FIC and NATC filing is projected onto one calendar — daily, monthly, quarterly and annual — with the due dates worked out for you.
6 PSP rules run over wallet, agent and cross-border activity and raise alerts with the evidence attached.
UN lists refresh every 6 hours and OpenSanctions — OFAC, EU, UK and more — every 12.
Alerts become cases. An analyst recommends a disposition; a different reviewer closes it.
When a key risk indicator breaches, Ontech PSP Compliance opens a risk and control self-assessment, recommends controls and notifies the owner.
248 Acts, statutory instruments, directives, circulars, rulebooks, guidelines and forms from 11 authorities, each with a SHA-256 checksum.
What a BoZ-designated payment service provider owes each authority, the deadline or threshold that comes with it, and the automation behind it. All payment-system returns go to the Bank of Zambia through the DFS portal, mandatory since May 2021 — late or incorrect returns cost K500 per return per day.
| Authority | Obligation | Deadline or threshold | What Ontech PSP Compliance does |
|---|---|---|---|
| BoZ | E-money transaction and balance limits (PSB Circular 01/2020) | Tier 1: K20,000 a day, K100,000 balance · Tier 2: K100,000 a day, K500,000 balance | Wallet-limit rule checks each customer against their KYC tier, across all their wallets |
| BoZ | Daily, monthly and quarterly payment-system returns (DFS portal) | Daily returns by close of the next business day; monthly and quarterly on the BoZ calendar | On the filing calendar with reminders and escalation |
| BoZ | Major operational or security incident report (e-money issuers and money-transfer providers) | Within 48 hours | Listed as an event-driven filing with its clock and source directive |
| ZECHL | National Financial Switch participation: disruptive-event and fraud reports, chargebacks and recalls, annual participation fee | Disruptive events within 24 hours; confirmed fraud immediately; chargebacks within 2 working days; K5,000 each January | Mapped to obligations, controls and filings from the ZECHL rulebooks; the filings switch on when you join the NFS |
| FIC | Suspicious transaction report, including attempted transactions | Within 3 working days of forming the suspicion | An STR disposition on the case drafts the goAML XML for review; the 3-working-day clock runs on the case |
| FIC | Currency transaction report | USD 10,000 or more, single or linked; within 3 working days | CTR drafts built daily for each customer's cash at or above the threshold, single or linked; the agent-structuring rule flags splitting |
| FIC | Wire transfer information | Full originator and beneficiary details from USD 1,000 | Incomplete-wire rule flags cross-border transfers missing either side |
| NATC | Targeted financial sanctions: freeze assets and report the freeze | Freeze without delay (NATC standard: 16 hours); report to NATC and the FIC | UN lists refreshed every 6 hours and national listings loaded from NATC's circulars; a confirmed match opens a freeze record with its 16-hour clock and drafts the NATC report |
| ODPC | Data controller registration and personal-data breach notification | Register before processing; notify breaches within 24 hours | On the obligations register with renewal and deadline reminders |
| CSA · ZICTA | Cyber Security Act 2025 duties if designated critical information infrastructure; ECT online-supplier registration, USSD short codes, SIM recycling | As prescribed by each instrument | Mapped as obligations; the conditional cyber duties switch on when you are designated |
| CCPC | Fee and price display; refund or re-perform failed services | Refund or re-perform within 14 days | Consumer-protection obligations mapped to controls and evidence |
| LCC · PAYZ · ZPPA | Lusaka City Council levies, rates, fire certificate and signage; PAYZ DFS Code (voluntary); e-GP supplier registration for government tenders | Annual or as applicable | Renewals on the calendar; voluntary and tender duties off until you opt in |
| BoZ |
Daily payment-system returns
DFS portal return
|
By close of the next business day | Scheduled every business day |
| BoZ |
Monthly payment-system returns
DFS portal return
|
About the 6th business day after month end (2026: 9 Feb, 10 Mar … 8 Dec; 11 Jan 2027) | BoZ dates loaded; reminders from 5 days out |
| BoZ |
Quarterly payment-system returns
DFS portal return
|
10 Apr, 10 Jul, 8 Oct 2026; 11 Jan 2027 | Reminders from 10 days out |
| BoZ |
Mobile money rewards return
DFS portal return
|
22 Apr, 22 Jul, 20 Oct 2026; 21 Jan 2027 | On the calendar with the rewards and remittance rules |
| BoZ |
Quarterly agent report and BCP/DR test report
DFS portal return
|
With the quarterly returns | Scheduled alongside the quarterly returns |
| BoZ |
Agent consumer-complaints report
DFS portal return
|
Monthly, with the monthly returns | Scheduled monthly |
| BoZ |
Annual attestation of vital statistics
DFS portal return
|
31 January (template issued through the DFS portal) | Reminders from 30 days out |
| BoZ |
Audited financial statements
DFS portal return
|
Within 3 months of financial year end | Reminders from 60 days out |
| BoZ |
Annual cyber maturity self-assessment
DFS portal return
|
Annually | On the calendar with its source guideline |
Built on BoZ limits and FIC thresholds, around the channels that carry the most money-laundering risk in the sector: agents, cross-border transfers and cash.
Daily value or balance above the customer’s KYC-tier limit, summed across every wallet they hold.
Cash-in or cash-out split across several agents to stay under the limits.
Many different senders paying one customer — the shape of a collection or mule account.
One customer paying many different recipients — the shape of a distribution network.
An electronic receipt taken out as cash at an agent soon after it lands. Higher severity when international or within 30 minutes.
Cross-border transfers at or above the FIC threshold with originator or beneficiary details missing.
Thresholds shown are the defaults; each institution tunes its own. Alongside them run seven general rules — structuring, velocity, round-tripping, dormant-account reactivation and more — machine-learning scoring, and the FATF high-risk country lists, kept to the latest plenary.
Five steps, the same every day, with a record of each one for the inspector.
Customers and their KYC tiers, wallets, agents and transactions from your e-money platform, through PSP Compliance’s ingest API or a file import.
PSP rules and sanctions screening run continuously; every alert carries its evidence.
Alerts become cases. An analyst recommends, a second reviewer decides.
STR and CTR drafts for goAML, NATC freeze reports, and returns and notices on the calendar with reminders.
Risk and compliance changes, case decisions, screenings and filings recorded with who, when and the reference.
Six quick questions on the duties inspectors look at first. Your answers stay in your browser — nothing is sent anywhere.
What protects your data and your decisions, switched on from the first day.
A password plus a one-time code sent by e-mail; accounts lock after 5 failed attempts.
Every API call checks who is signed in and what their role may do.
Every risk and compliance change, case action, screening and filing recorded with who and when.
Cross-site request forgery protection on every form and a strict content security policy on every page.
If the sanctions lists cannot be searched, screening stops rather than clearing anyone.
Operated by Ontech Solutions, a registered data controller (ODPC, DP000394).
Everything you need to know about PSP Compliance.
Questions about your obligations, a walkthrough for your team, or your own demo instance.
We’ll walk your compliance team through your BoZ filing calendar, your FIC reporting and the PSP detection rules — on your own numbers.
Monitoring, screening, goAML reporting and every BoZ, FIC and NATC filing — in one platform.
