CLIENT ALERT: Data Protection And Privacy In Disclosure Of Beneficial Ownership Information Under The Companies Act, 2015

CLIENT ALERT: Data Protection And Privacy In Disclosure Of Beneficial Ownership Information Under The Companies Act, 2015

Posted on March 22nd, 2021

On 13th October 2020, the Registrar of Companies operationalised the Beneficial Ownership E-Register pursuant to Section 93A of the Companies Act (hereinafter ‘the Act’) and the Companies (Beneficial Ownership Information) Regulations (hereinafter ‘the Regulations’). These regulations require that legal entities keep a Beneficial Ownership register and submit a copy to the Registrar of Companies (hereinafter ‘the Registrar’) failure to which the entity and its defaulting officers commit an offence and are liable for a fine upon conviction.

Effectively, every company incorporated or registered in Kenya will now be required to keep two separate registers: 

a) a register of members.

b) a register of beneficial owners.

The two registers are required to be lodged with the Registrar of Companies upon any change in legal or beneficial ownership of a company.

1. Why is disclosure of beneficial ownership important?

According to the Financial Action Task Force (hereinafter ‘the FATF’) which is the global body that sets standards for Anti-money laundering compliance, legal entities are potentially at risk of being misused to facilitate criminal activities. Anonymity enables illegal activities to take place away from the scope of law enforcement authorities thus enabling activities such as corruption, money laundering, financing of terrorism and tax evasion.

Disclosure of beneficial ownership (hereinafter ‘BO’) information is therefore necessary as it plays a central role in transparency and ensuring integrity in corporate structures.  Such disclosure helps verify that the finances of a legal entity are not proceeds of crime and enables authorities to detect and prevent crimes such as tax evasion, corruption, money laundering, terrorist financing, and other illicit activities.

2. Which legal persons does it affect?

The BO regulations apply to all companies that are incorporated or registered under the Companies Act, 2015. For the avoidance of doubt, all companies incorporated before 2015 are subject to this Act.

The regulations also apply to other legal entities such as foreign companies, limited liability partnerships, limited partnerships, trusts and co-operative societies to the extent that they are shareholders in the companies mentioned above and qualify as beneficial owners according to the criteria discussed in 3 below.

3. Who is a beneficial owner?

A beneficial owner means “a natural person who ultimately owns or controls a legal person or arrangements or the natural person on whose behalf a transaction is conducted and includes those persons who exercise ultimate effective control over a legal person or arrangement.”

The criteria for identifying a beneficial owner is as set out in the Regulations which provide that a BO is someone who: –

  • directly or indirectly holds at least 10% of the issued shares in a company; or
  • possesses the direct or indirect power to appoint or remove a director of the company; or
  • indirectly or directly exercises significant influence or control; or
  • directly or indirectly exercises a minimum of 10% of the voting rights in a company.

Where two or more persons hold shares in a company jointly, each is taken as holding full interest. Therefore, if the shareholding qualifies under any of the criteria above, each of the joint shareholders is treated as a beneficial owner and must be disclosed accordingly.

The definitions capture the intent of the Anti-Money Laundering Laws as full compliance with the regulations ensures that relevant authorities can verify an entity’s financial transparency and verify its finances are not proceeds of crime.  

4. What is the process Involved?

Notably, there are no additional requirements for non-resident beneficial owners. All beneficial owners ought to provide the relevant particulars as set out in the regulations. The register of beneficial owners should contain particulars of each beneficial owner, which includes the following:

  1. full name;
  2. birth certificate number, national identity card number or passport number;
  3. nationality;
  4. date of birth;
  5. postal, business and residential address, telephone number and email address;
  6. occupation or profession;
  7. personal identification number; and
  8. the nature of ownership or control, including the date when a natural person became a beneficial owner, the date on which a person ceased to be a beneficial owner and any other
  9. the event relevant details the Registrar may require.

If a BO fails to submit the required information, the regulations allow for issuance of a warning notice requiring compliance within 14 days, failure to which the BO’s relevant interests can be restricted.  

5. Will the information be publicly available?

The beneficial ownership information shall not be made available to the public. The Regulations only permit disclosure:

  • where it is for communication purposes with the beneficial owner for compliance with the Regulations;
  • in compliance with a court order;
  • upon the request of a competent authority such as the office of the Attorney General and an investigative agency; or
  • with the written consent of the beneficial owner.

The Regulations make it an offence punishable by a fine not exceeding KES 20,000 or imprisonment for a term not exceeding 6 months, for the company to unreasonably disclose beneficial owners’ information.

6. What if the beneficial owner is an entity?

The BOs of legal persons or legal arrangements must always be individuals (natural persons), who own or control, either through direct or indirect means. Where the BO is an entity, it would be necessary to identify the beneficial owners or personas with the ultimate control of these entities using the same criteria set out in paragraph 3 above.  

For legal arrangements such as trusts, the transparency requirement goes beyond focusing on one BO and requires the trustee (or similar agent) to obtain information on any settlor, other trustees, the protector, beneficiaries (or class of beneficiaries), and any other natural person exercising ultimate effective control over the arrangement.

All the parties to a trust or other legal arrangement are therefore identified as beneficial owners irrespective of whether or not any of them exercises control over the trust.

7. In future, at what intervals should a company update its BO register?

An entity is required to submit it’s initial copy of the BO register to the Registrar of Companies within 30 days of preparation. After that, an entity is required to update any changes in beneficial ownership information in timely manner and notify the Registrar within 14 days of such change. Public listed companies are however exempted from the requirement to strictly submit the amendments within 14 days.  The BO register is therefore not updated annually but rather every time there is an update on such information.

8. What are the relevant dates and timelines?

Legal persons and legal arrangements are required to submit their BO information by 31st July 2021.

9. Do the regulations introduce any offences?

According to section 93A of the Companies Act, failure by a company to comply with the disclosure requirements is an offence which on conviction attracts a fine not exceeding Kenya Shillings Five Hundred Thousand (KES 500,000/=) payable by the company and each officer of the company in default. Further, if the non-compliance continues, the company and the officers in default shall be liable for an additional fine not exceeding Kenya Shillings Fifty Thousand (KES 50,000/=) per day.

10. What steps should be taken?

Some of the steps that officers of legal persons and legal arrangements could take include:

  • Take reasonable steps or measures to identify its beneficial owners using the criteria set out in 3 above. This could be done through: –
    • Reviewing any evidence that may show interests or rights held through a variety of means that may ultimately be controlled by the same person; and identify all-natural persons holding such rights e.g. rights to dividends or distributions attached to the shares or rights to participate in a return of capital and rights to exercise options to redeem their shares.
    • Review all documents and information available at the company’s level (e.g. register of members, constitutive documents, certificates of incorporation/ compliance/ registration, etc).
  • Notify persons whom they know or have reasonable cause to believe are beneficial owners to submit the prescribed information. The regulations requires that the BO should submit such information within 21 days of receiving this notice.
  • Keep a register of its beneficial owners and enter in that register information relating to its beneficial owners as prescribed in the Regulations.
  • Submit a copy of the register to the Registrar of Companies within 30 days of preparation as required by the Regulations. Updating the e-register in case of any change in the beneficial ownership information and notify the Registrar within 14 days.
  • Issue warning notices for BOs who do not submit the information with the required time and restrict the relevant interests of such persons in the event that they do not comply with the warning notice within 14 days as required by the Regulations.
  • Record the details of any identified BO’s who have failed to submit the information, and the action taken.
  • Incorporate BO Disclosure requirements in its Articles of Association and annual compliance processes.
  • Safeguard the information against unauthorized disclosure.

11. In the context of data protection and privacy, what should be considered?

When companies are compiling information of the Beneficial Owners, they act as data controllers and are thus subject to the provisions of the Data Protection Act, 2019. They have a duty to keep the data of the data subjects (beneficial owners) in a manner consistent with the Data Protection Law, including that personal data should be processed in accordance with the right to privacy of the data subject. The Regulations prohibit companies from disclosing the details of a beneficial owner without the written consent of the beneficial owner, except for where disclosure is made pursuant to a court order.

The Registrar of Companies may only disclose the information relating to a beneficial owner to a competent authority upon a written request by the competent authority.

A competent authority is defined to mean the Attorney General, criminal investigation and law enforcement agencies, and authorities that supervise and monitor the financial sector, including Financial reporting Centre and the Kenya revenue Authority.

The need to disclose BOs information, although subject to Data Protection Laws, undermines confidentiality within the business realm. For instance, where a search is conducted, it is not clear whether the BOs personal details will be available as well. This may ultimately ward off both local and foreign investors who seek for privacy as they consider investment options. This may ultimately create a ripple effect on the economy.


The intention of the BO requirement is indeed a noble idea especially in Kenya where the government has in the recent past set up institutions and systems to combat corruption, terrorism, money laundering and international crime. Caution should be taken to ensure that  enforcement of this new requirements does not cause more harm than good to the business environment especially if it is not confined within the privacy laws. The government should focus on the integrity of organizational and technical measures applied to the process with an aim to inspire confidence in the potential investors and the business community at large.

For more information, reach out to our Telecommunications, Media and Technology Team through Deputy Managing Partner and Head of TMT Catherine Kariuki, Partner Janet Othero, Associates Sherry Bor and Joyanne Njau.