•
Across Eastern and Southern Africa, banks and virtual asset service providers (VASPs) have, independently and without coordinating, converged on strikingly similar anti-money laundering controls: risk-based customer due diligence, tiered onboarding, transaction monitoring built to flag anomalies rather than punish ordinary behaviour, and escalation into a dedicated financial crime function. What they lack is any shared, structured mechanism to compare notes with one another. That gap, not a shortage of individual compliance effort, is the region's most consequential unaddressed AML vulnerability, and its clearest near-term opportunity for regulators to act.
The gap is not abstract. Sub-Saharan Africa's average cost of sending remittances, runs close to 7.9%, more than double the United Nations' Sustainable Development Goal target of 3%, with several economies, including Sierra Leone, Uganda, Angola, Botswana, and Zambia, exceeding 7% outright. A material share of that cost is compliance friction passed down a shrinking correspondent banking network: the top twenty correspondent banks, now handle roughly 80% of global cross-border payment value, a concentration driven by de-risking as banks withdraw from relationships they judge to carry uncertain regulatory expectations and disproportionate compliance cost, with the steepest reductions falling on African, Pacific Island, and Caribbean institutions.
Regulation has not closed this gap on its own. FATF’s most recent targeted update found that 83% of surveyed jurisdictions have now enacted Travel Rule legislation, up from 73% a year earlier, yet most are still struggling to convert that legislation into effective supervision, and continue to struggle simply identifying which entities within their borders are conducting VASP activity at all. Legislative adoption has outpaced operational interoperability, region-wide.
This is the backdrop against which the convergence problem matters. At ESAAMLG's ninth Public-Private Sector Dialogue in Kigali in September 2026, a panel on electronic Know-Your-Customer and Transaction Monitoring brought together compliance leaders from two commercial banks, Commercial Bank of Mauritius and BPR Bank Rwanda Plc, and Yellow Card, a pan-African VASP. In preparatory discussions ahead of that panel, Chanal Subramoney, Group Senior Compliance Manager (Group MLRO) at Yellow Card, found that the controls described by the two banks and by Yellow Card were, in substance, close to identical. Three institutions, three industries, three regulators, and near-identical answers, arrived at without any of them coordinating with the others.
That is the evidence that the underlying capability already exists in the region. What does not exist is the connective layer. A single illicit flow that moves through a bank account, into a VASP wallet, and back through a second bank passes through three individually competent compliance programmes, and none of the three sees the full pattern, because there is no lawful, structured channel for them to exchange what each has observed. The financial system has already demonstrated that this kind of shared infrastructure works: SWIFT's KYC Registry reduces duplication in correspondent due diligence globally by giving institutions a common, verified data source rather than requiring each to rebuild the same picture independently. No equivalent, purpose-built mechanism exists in the ESAAMLG region for the specific combination this gap concerns: banks and VASPs, under different licensing regimes, sharing compliance-relevant information in a structured, lawful way.
The cost of that absence is not evenly distributed. Absent shared visibility, institutions compensate for what they cannot verify independently by defaulting to broader caution, and that caution lands hardest on ordinary, low-value activity, the remittance, the savings deposit, the transaction that constitutes the overwhelming majority of financial inclusion use cases in the region. A connected compliance ecosystem would let institutions, and their supervisors, be precise about where genuine risk actually sits, rather than treating every transaction as equally suspect because visibility stops at each institution's own perimeter.
Regulators in the region already have reason to believe industry is ready to move. Since the Kigali dialogue, ESAAMLG has invited continued engagement from Yellow Card on awareness and training, and more than one national financial intelligence unit has approached the company directly for input on drafting its own virtual asset regulation. Both are signals that the private sector is being invited further into the design of these frameworks, not merely consulted once they are finished.
The recommendation that follows is specific. Regulators, including central banks, financial intelligence units, and regional standard-setters such as ESAAMLG, should take the lead in convening and building a shared, cross-sector, cross-border compliance information-sharing mechanism, one that licensed banks and VASPs can use to support joint investigations, calibrate risk-based monitoring collectively rather than in isolation, and align emerging Travel Rule data standards with the operational reality of institutions at very different levels of technical maturity. Regulators are best placed to set the legal basis, data protection safeguards, and participation rules such a mechanism requires. Industry has already shown, independently, that it can converge on compatible control design; it is positioned to help build the connective layer quickly once regulators choose to lead. The region has shared instincts. It does not yet have the infrastructure to act on them together, and that infrastructure is now a decision for regulators to make.
