Zimbabwe KYB in 2026: What Fintechs Must Do Before the Re-registration Deadline

Zimbabwe is mid-way through a genuine overhaul of its corporate registry, and that overhaul has direct implications for how regulated businesses verify corporate clients. VOVE ID helps compliance teams keep pace as verification volumes and document formats both shift.

This guide covers business verification requirements in Zimbabwe. For the underlying KYB framework, see our KYB Requirements Explained 2026.

Regulatory Context: What Changed, and What Changed Again

Under the Companies and Other Business Entities Act (COBE), entities incorporated before the electronic registry's cutover date must re-register to stay on the register. The original deadline — 20 April 2026, set by Statutory Instrument 108 of 2025 — was extended to 20 April 2028 by Statutory Instrument 76 of 2026, after reports that a large share of companies (some estimates put it as high as 80%) still hadn't completed digitization as the original date approached, alongside recurring technical issues with the registration system.

For onboarding teams, that means the operational risk hasn't disappeared — it's just moved. Businesses still need to re-register, and PACRA is still issuing modern, QR-coded certificates that support instant digital authenticity checks. But there's no longer a hard cliff at April 2026 forcing every counterparty to have a fresh certificate by then.

Who enforces business verification:

• RBZ: supervises banks, payment providers, mobile money operators, and fintechs.
• FIU: enforces AML obligations, including corporate customer verification and suspicious activity reporting.
• PACRA (Companies Registry): issues QR-coded certificates and manages the re-registration process.

For customer due diligence requirements for individual customers, see our KYC guide for Zimbabwe.

Penalties and Enforcement Powers

Under Zimbabwe's administrative penalty scale, Level 14 fines generally fall between USD 5,000 and USD 20,000 for KYB or AML non-compliance. For serious or repeated AML breaches, the FIU can apply multipliers, with penalties reaching into the hundreds of thousands of dollars for systemic failures, alongside authority to freeze accounts or suspend operations.

Core KYB Requirements

1. Company documentation Verify whether a business holds a current, QR-code-authenticated PACRA certificate. The QR code enables instant digital validation and helps flag companies whose registration status may be uncertain during the (now extended) transition.

2. Identity and authority of key persons Confirm who manages the business and who is authorized to act on its behalf — ID verification, role confirmation, and screening for conflicts or elevated risk.

3. Ownership and control structure Trace the full chain of control to natural persons. Zimbabwe applies different beneficial-ownership tests depending on context: company law uses more than 20% of shares or voting rights (or majority director-appointment rights, or other significant control); the AML Act separately uses a 25%-or-more deemed test; and RBZ's 2025 banking guideline directs banks and microfinance institutions to identify beneficial owners at 10% ownership and above. Apply the threshold that matches the rule you're actually working under, not a single blended figure.

4. Business activity and risk evaluation Assess whether the company's stated purpose aligns with expected behavior, and whether risk indicators place it in a higher-risk category.

5. Company address and residency rules A verifiable operating address is mandatory. Residency requirements vary by entity type: since 2023, Private Business Corporations (PBCs) may be formed entirely by non-residents. Private Limited Companies (PLCs), however, must still appoint at least one resident director under COBE section 195.

Practical Considerations for 2026–2028

• Re-registration status still matters, even without a near-term hard deadline — verify whether a counterparty has completed the process, since re-registration status still signals how current the company's on-file information actually is.
• Prioritize QR-coded documents during onboarding and periodic review; they're faster and harder to falsify than the older paper format.
• Re-check after ownership or governance changes, which re-registration often triggers.
• Document risk classifications thoroughly — the FIU expects justification for every risk rating, even for entities that appear low risk.

How VOVE ID Supports KYB in Zimbabwe

VOVE ID helps compliance teams:

• Validate QR-coded PACRA certificates for authenticity.
• Verify the identities of officers and decision-makers.
• Flag gaps or inconsistencies in corporate information.
• Maintain complete audit trails for FIU inspections.

For the complete, sourced requirement-by-requirement checklist, see VOVE ID's Zimbabwe compliance checklist.

Conclusion

Zimbabwe's shift to a modern corporate registry is real, but the timeline just moved — and that's exactly the kind of change onboarding teams need to track closely rather than assume away. Institutions that verify re-registration status, use QR-code authentication, and document risk classifications properly are the ones positioned to handle whatever the next deadline extension brings.

This article is intended for general informational purposes only and does not constitute legal, financial, or regulatory advice. KYC/KYB/AML requirements may vary depending on jurisdiction, industry, and specific business circumstances. For up-to-date and binding compliance obligations, readers should refer to the relevant regulatory authorities or consult qualified professionals.