KYC Compliance in the DRC: 2026 Guide for Regulated Businesses

The Democratic Republic of Congo is a genuinely hard market to onboard in — a largely cash-based economy, uneven ID coverage, and patchy connectivity outside the major cities all push against fast, reliable KYC. It's also a market in motion: mobile money adoption keeps climbing, and the national DRCPass digital ID system began its full public rollout in June 2026. VOVE ID supports fintechs, digital wallets, and lending platforms building compliant onboarding for exactly this environment.

This guide covers customer due diligence for individuals in the DRC. For the underlying KYC framework and workflow fundamentals, see our KYC Requirements Explained 2026.

Who Governs KYC in the DRC

• Banque Centrale du Congo (BCC): sets KYC and AML/CFT rules for banks, microfinance institutions, and mobile money providers via BCC Instruction No. 15 (2018).
• CENAREF (Cellule Nationale de Renseignements Financiers): the Financial Intelligence Unit, responsible for collecting and analyzing suspicious transaction reports (STRs).
• GABAC & FATF: as a member of GABAC, Central Africa's FATF-style regional body, the DRC aligns with FATF's 40 Recommendations. A 2020 mutual evaluation identified gaps in customer due diligence and terrorist-financing controls; the country made a high-level political commitment to FATF and GABAC in October 2022 and has been under FATF increased monitoring (the "grey list") since. At its June 2026 plenary, FATF made an initial determination that the DRC has substantially completed its action plan and now warrants an on-site assessment — a meaningful step toward possible exit, though the grey-list status remained in force as of that statement.
• Law No. 04/016 (19 July 2004), amended by Law No. 16/002 (2016) and substantially updated by Law No. 22/068 (December 2022) — which banned anonymous accounts, expanded the range of regulated entities (including fintechs, casinos, and real estate), and strengthened PEP screening — is the current legal basis for KYC obligations.
• Law No. 17/001 (2017): the data protection law governing KYC-related personal data.

For the AML enforcement structure behind these obligations, see our AML Requirements Explained 2026.

Core KYC Requirements

Identify and verify the customer

Collect an official identity document — national ID card, passport, driver's license, or a voter card issued by CENI — and validate it against security features, screening the customer against sanctions lists (UN, OFAC and others).

Determine the beneficial owner

For corporate clients, identify the natural persons with significant ownership or control. Retain this data for 10 years post-relationship, under Law No. 04/016 as amended.

Apply a risk-based approach

Enhanced Due Diligence (EDD) applies to high-risk profiles — PEPs, or clients connected to other FATF grey-listed jurisdictions.

Report to CENAREF

Suspicious activity must be reported within 24 hours of detection.

For business verification and beneficial ownership requirements, see our KYB guide for the DRC.

Digital Identity: Where It's Actually Changing

Two developments are reshaping onboarding in the DRC at the same time:

• DRCPass (RDC-Pass): the country's national digital identity system, delivered through a 20-year public-private partnership with Trident, moved from signing (June 2025) to full public rollout in Kinshasa in June 2026, as part of a $1 billion national digital-development plan running through 2030. Trident has been named the country's exclusive electronic KYC (e-KYC) provider for government-linked identity checks — a separate track from the KYC work regulated businesses still need to run for their own customer files.
• Mobile money growth: adoption via platforms like M-Pesa and Airtel Money continues to climb, at 47% mobile penetration nationally (GSMA, 2024).

Meanwhile, the underlying constraints haven't gone away: roughly 60% of the population still lacks formal identification, and the economy remains heavily cash-based, which keeps pushing fintechs toward hybrid verification — digital-first, with agent-assisted fallback for lower-connectivity areas.

Where KYC Still Breaks Down

• Low ID penetration, particularly outside Kinshasa and Lubumbashi.
• Cash dominance, which limits the paper trail eKYC and transaction monitoring can build on.
• Connectivity gaps in rural areas, constraining fully digital onboarding.
• Cross-border complexity: traders and customers moving across the eastern border region (with connections to Rwanda, for instance) often need enhanced due diligence layered on top of standard KYC.

Hybrid models — automated verification backed by agent-assisted checks — remain the practical way to reach unbanked and rural populations without cutting corners on compliance.

How VOVE ID Supports KYC in the DRC

VOVE ID is built for exactly this kind of low-documentation, low-connectivity environment:

• OCR-based document verification for Congolese and foreign IDs, including security-feature checks.
• Sanctions and PEP screening, applied at onboarding and on an ongoing basis.
• Biometric liveness detection and face matching, to catch spoofing even where ID coverage is inconsistent.
• French-localized, mobile-first onboarding, built for the country's mobile-majority user base.
• Audit-ready logging, structured for BCC and CENAREF review.

FAQ

What documents are used for KYC in the DRC? National ID cards, passports, driver's licenses, or CENI-issued voter cards.

Is eKYC mandatory in the DRC? It isn't mandated outright, but BCC and international donors actively encourage it as part of the FATF reform roadmap.

Who enforces AML/KYC compliance in the DRC? BCC oversees financial institutions; CENAREF handles suspicious transaction reports and financial intelligence.

What are the penalties for non-compliance? Fines, license suspension, or legal action, scaled to the severity of the violation, under Law No. 22/068.

For the complete, sourced requirement-by-requirement checklist, see VOVE ID's the DRC compliance checklist.

Conclusion

KYC in the DRC in 2026 sits at an unusual intersection: a national digital ID system just went live, FATF has signaled the country may be close to exiting the grey list, and the underlying cash-heavy, low-connectivity reality hasn't changed nearly as fast. Businesses that build for both — the digital opportunity and the offline constraints — are the ones actually able to scale here.

This article is intended for general informational purposes only and does not constitute legal, financial, or regulatory advice. KYC/KYB/AML requirements may vary depending on jurisdiction, industry, and specific business circumstances. For up-to-date and binding compliance obligations, readers should refer to the relevant regulatory authorities or consult qualified professionals.