Private Voluntary Organisations (Risk-Based Supervision and Protection from Terrorist Financing Abuse) Regulations, 2026

Private voluntary organisations are placed under risk-based supervision built on FATF Recommendation 8. The Registrar classifies the subset of PVOs that meet the FATF definition of a non-profit into high, medium or low risk, notifies each in writing with reasons, and must run a process for leaving the high-risk register once the risk factors are mitigated. A high-risk designation can be appealed under the Act.

A PVO is designated high risk on any one of three grounds: it operates in or materially supports an active conflict zone or a jurisdiction with an active terrorist threat; it regularly moves cash or equivalent value across borders exceeding US$50 000 to high-risk jurisdictions; or it uses complex, opaque structures that intentionally impede identification of its beneficial owners.

What each tier must do differs sharply. High risk means quarterly detailed financial returns with verified sources of funds and beneficial ownership of significant donors, targeted on-site inspections, an annual independent external audit focused on AML/CFT controls, and mandatory Know Your Donor and Know Your Beneficiary checks on transactions above US$50 000. Medium risk means annual returns and audited financial statements, desk-based reviews, and five years of records on significant donors, beneficiaries and transactions. Low risk means a simplified annual activity report and basic financial summary, exemption from mandatory external AML/CFT audits, and monitoring mainly through outreach — the guidance identifies a low-risk PVO as one with annual income under US$50 000, no permanent full-time staff, and operations strictly inside Zimbabwe.

The foreign funding rule catches far smaller organisations than the designation criteria. Regardless of existing risk rating, a PVO receiving a single donation or cumulative annual funding above US$5 000 from a high-risk jurisdiction is monitored as high risk for that financial year, and must file a Foreign Funding Disclosure Form with the Financial Intelligence Unit within thirty days giving the donor's identity and beneficial ownership, the project funded, and the banking channels used. A high-risk jurisdiction includes anything on the FATF black or grey list — and any jurisdiction where the PVO cannot independently verify the donor's beneficial ownership. If the Unit raises no query within fourteen days, the PVO may spend the funds.

Enforcement powers are broad. On reasonable suspicion the Registrar or an FIU officer may enter premises and seize financial documents; the Registrar may compel production of financial records, beneficiary lists and partner agreements, and may issue compliance orders giving ninety days to fix weak internal controls. Registration must be revoked where a PVO knowingly supported a terrorist organisation or persistently fails high-risk measures, subject to appeal to the Administrative Court, and revocations are published in the Gazette. Penalties are graduated from a written warning and mandatory training, through fines proportional to annual budget and suspension of specific activities, to deregistration as a last resort. Failing to notify a material change in funding attracts a fine up to level 10; ignoring a high-risk directive, up to level 12.

Every PVO in the subset must keep conflict of interest registers, dual financial authorisation and procurement policies, donor and beneficiary due diligence, UN Security Council sanctions screening, five years of transaction records and seven years of accounting records, and must file suspicious transaction reports within three working days of forming a suspicion. Cash donations above the threshold must be reported within seven working days.

There is a counterweight built in. Umbrella bodies can be granted Recognised Status, and a PVO in good standing with one gets reduced due diligence and priority for low-risk categorisation. The regulations repeatedly require supervision not to disrupt legitimate charitable work or delay humanitarian assistance.

One caution on the text: the Parts run I, II, III, then V — there is no Part IV, and section 25(2) contains an incomplete sentence.