Your Donor Is Now Your Regulator

When the Kenyan government has wanted to restrict civil society, it has used the registration system. The NGO Co-ordination Board was the mechanism. The story of Kenya's civil society development sector in the 1990s and early 2000s is, in significant part, a story of organisations learning to navigate, and occasionally challenge, a regulatory body that was susceptible to political direction. The threat was the regulator. The protection was donor funding, international visibility, and the network of relationships that made deregistration politically costly.

Something has changed. The regulatory pressure on Kenya's civil society now comes, in significant proportion, from the donor community itself. The foundations, bilateral agencies, and international NGOs that fund a large fraction of Kenyan civil society work have, over the past decade, tightened their due diligence requirements in ways that are producing compliance pressure the Kenyan state has never consistently managed to apply. The organisations that cannot demonstrate legal standing, auditable financial systems, and governance accountability frameworks are no longer merely at risk from a hostile government. They are at risk of losing the funding that was historically their protection against that hostility.

This is not a conspiracy. It is the structural consequence of several developments in international development finance, not all of them pulling in the same direction — one of them, taken up directly in §5, upended the landscape this paper describes.

One gate stands open with no one watching it. The other is the one that actually has to be passed.

1. What This Argument Rests On

What it argues from. The documented history of FATF Recommendation 8 and its 2016 and 2023 amendments, read directly from a civil-society implementation guide that cites FATF's own publications.¹ A directly confirmed fact about USAID's institutional status as of mid-2025, which materially changed one of the two donor-side developments this paper originally argued from. The current EU external-action financing instrument, correctly identified. Press-reported, order-of-magnitude figures on the scale of USAID's withdrawal from Kenya specifically. Flux's own field observation from AccessWASH's WASH-sector deployments, named as internal and unaudited.

What it does not argue from. It does not argue from a dataset of Kenyan CBOs tracking which specific due-diligence requirement caused which specific funding loss — no such dataset is cited because this paper did not find or build one. It does not argue that FATF Recommendation 8 is, on its current text, a cause of donor over-compliance; §6 states directly that FATF's own recent amendments argue against exactly the pattern this paper describes, which complicates rather than supports a simple "FATF made them do it" causal story.

What it does not claim. It does not claim international donors act in bad faith; §3 states plainly that the individual due-diligence requirements driving this pattern are, each on its own terms, defensible responses to real risks. It does not claim the compliance-pressure story is now the dominant donor-relations story in Kenyan civil society; §5 argues the collapse of a major bilateral donor is, for 2025-2026 specifically, probably the bigger story, and that the donor relationship itself can be more unstable than compliance pressure alone would suggest.

What would refute it. Given in full in §9. The sharpest version: if a rigorous study finds Kenyan organisations' funding losses in 2024-2026 are overwhelmingly explained by donor budget contraction and the closure of specific bilateral programmes, rather than by due-diligence/compliance failure specifically, this paper's framing of "donor as regulator" would be shown to describe a secondary mechanism dressed up as the primary one, and the paper's emphasis would need to shift substantially toward §5's argument rather than §2-4's.

2. How Due Diligence Became Compliance Regulation

International due diligence requirements for civil society partners are not new. Donors have always asked potential partners to demonstrate legitimacy — to show they are what they say they are, that their finances are managed by someone accountable, and that the money will reach the intended beneficiaries. For most of the 2000s, these requirements were met by producing registration certificates, audit reports, and organisational profiles. For an established NGO with a legal team and a finance function, this was straightforward. For a community-based organisation, it was manageable.

What changed is the regulatory environment in which international donors themselves operate, and two developments are directly relevant — though, as §6 argues, the first of them is more complicated than it first appears.

The first is the Financial Action Task Force's Recommendation 8, which designates non-profit organisations as a sector requiring attention under anti-money-laundering and counter-terrorist-financing frameworks. The FATF is an inter-governmental body whose recommendations, while not binding in themselves, are implemented through member countries' national legislation and through the self-regulatory standards of financial institutions, and non-compliance can raise a country's cost of access to international financial systems. Its historical classification of the NPO sector as warranting scrutiny has, in practice, produced a trend worth naming carefully: financial institutions tightening the conditions under which they will provide banking services to NPOs, and donors operating under FATF-aligned national regulations tightening the conditions under which they will fund NPO partners in jurisdictions FATF flags for increased monitoring.

Kenya has been under FATF's increased-monitoring process — commonly called the "grey list" — since February 2024, and remained listed as of the Plenary statement issued 19 June 2026, with seven specific areas (including risk-based supervision, beneficial-ownership transparency, and money-laundering prosecution rates) named as still requiring work.² Being grey-listed raises the due diligence obligations of international funders working in Kenya, because working with Kenyan partners is classified as inherently higher-risk by institutions applying FATF-aligned rules mechanically.

The mechanism by which a non-binding inter-governmental recommendation becomes a felt compliance burden for a rural CBO runs through an intermediate layer this paper has not yet named directly: commercial banks. A bank that wants to avoid the cost and reputational risk of a weak FATF mutual-evaluation finding has an incentive to apply its own, often more conservative, screening to any client it classifies as NPO-adjacent — closing accounts, delaying transfers, or declining new relationships rather than doing the harder work of risk-differentiating within the sector. This is the behaviour FATF itself now calls "de-risking," and §6 takes up directly what it means that FATF has spent a decade trying to stop banks and donors from doing exactly this.

The second development concerns the standardisation of partner-vetting frameworks across major bilateral and multilateral funders. This paper's original research into USAID's specific vetting requirements is now largely historical rather than current — §5 explains why in detail — but the European Union's main external-action financing instrument remains active and relevant: the Neighbourhood, Development and International Cooperation Instrument — Global Europe (NDICI-Global Europe), established by Regulation (EU) 2021/947 of 9 June 2021, requires financial accountability and organisational-assessment processes for civil society partners receiving EU external-action funding.³ Large private funders have, separately, adopted grantee due-diligence frameworks that require registration under a legally recognised civil-society framework as a precondition for grant agreements above certain thresholds.

These requirements are not coordinated with each other. They are not designed to produce the same effect. But their combined impact on the Kenyan civil society landscape has been, in practice, regulatory: they define a compliance threshold an organisation must meet to access a large share of international funding, and that threshold now requires PBO registration or equivalent legal standing in almost every serious partnership context — a registration process whose own barriers are examined in detail in Kenya's PBO Act is finally in force after a decade.

3. The Distribution Problem

The organisations most capable of meeting these requirements are not randomly distributed across Kenya's civil society. They are concentrated among older, Nairobi-based organisations with established legal and finance functions — the organisations that have been operating long enough, and at a scale large enough, to have hired the staff and built the systems that due diligence requires.

Community-based organisations doing last-mile work — in health, water, protection, and food security — are disproportionately represented in the non-compliant tail. They are the organisations most likely to lack PBO registration, most likely to have financial systems below the threshold of auditability international donors now require, and most likely to have governance structures that do not satisfy the specific composition and accountability requirements donor frameworks now mandate.

The irony is precise. The organisations international funders most want to reach — the ones with genuine community trust, embedded field presence, and programmatic reach into populations larger NGOs cannot access — are the ones most likely to be excluded by the compliance requirements those funders now impose.

This is not, on this paper's argument, a story about donor bad faith. The due diligence requirements exist for reasons that are, individually, defensible. No donor wants to be named in a financial-crime investigation because a partner organisation was used as a conduit. No donor wants to be unable to account for how its funds reached the intended beneficiaries. The requirements are responses to real risks and real accountability obligations.

But good individual reasons can produce bad collective outcomes. The compliance threshold, across the sector as a whole, has been sorting Kenya's civil society by administrative capability rather than programmatic effectiveness. Organisations good at compliance have been getting the funding. Organisations good at the work have increasingly found the funding inaccessible — though, as §5 argues, this pattern shared the stage, in 2025-2026, with something considerably more disruptive.

4. What the Compliance Gap Actually Costs

I want to make this concrete. In the WASH sector, the organisations doing demand-side monitoring in rural Kenya — tracking household water quality, identifying usage patterns, flagging system failures before they become service interruptions — are mostly CBOs with annual budgets well under a million shillings, run by a coordinator and two or three field staff. They cannot afford a lawyer to fix their constitutions. They cannot afford an audit from a registered CPA firm. They do not have a finance officer capable of producing quarterly financial reports in the format international donors now require.

The operational data these organisations generate — household connection status, water quality test results, system uptime records — is precisely the data water utilities and county governments need for planning and accountability. In Flux's own AccessWASH deployment experience, the funding these organisations need to keep generating it is precisely the funding compliance requirements now condition on administrative capabilities they do not have.⁴ This is internal observation from one company's own field deployments, not an independently audited dataset, and should be read with that limitation attached.

The compliance gap, in this sector as in others, is not costing Kenya administrative tidiness. It is costing operational coverage. The early-warning capability for water-system failures exists inside the organisations doing the monitoring. It disappears from practice when those organisations lose funding because they cannot pass a due-diligence threshold designed for organisations operating at a different scale.

5. When the Donor Itself Disappears

The tightening of donor compliance requirements described in §2-4 is not the whole of the 2025-2026 story for Kenyan civil society's donor relations — and arguably not even the central part of it.

On 1 July 2025, the United States Agency for International Development ceased to exist as an independent agency. Secretary of State Marco Rubio announced its closure directly: "As of July 1st, USAID will officially cease to implement foreign assistance," with its remaining compatible programmes folded into the State Department.⁵ This was not a tightening of partner-vetting requirements. It was the removal of one of the largest bilateral donors to Kenyan civil society, essentially without a transition period for the organisations that depended on it.

Press reporting from March 2025 — labelled here as order-of-magnitude, not a precise or audited figure — put the value of terminated USAID contracts and grants in Kenya at roughly KES 108 billion (on the order of $800 million), across some 80 affected projects, with civil-society and community-based organisations reporting that tens of thousands of workers were at risk of losing their jobs in the immediate aftermath.⁶ Programmes specifically serving vulnerable groups — HIV and TB response, orphans and vulnerable children, maternal health — were named in that reporting as directly affected.

Order-of-magnitude, press-reported figures — not an audited reconciliation (Appendix A row 5).

This matters for this paper's argument in two ways that pull in different directions.

First, it is a sharper, starker version of this paper's own thesis, not a contradiction of it. If "your donor is now your regulator" describes an organisation's fate turning on satisfying a funder's requirements, the USAID closure is the most extreme version of that dependency: an organisation could have satisfied every due-diligence requirement USAID itself had ever asked of it, and still have lost the funding entirely, because the donor-as-institution stopped existing. A regulator that can simply disappear, with no appeal and no transition period, is a more totalising form of dependency than a regulator that merely tightens its requirements over time.

Second, and in real tension with the first point, it complicates the specific compliance-pressure mechanism §2-4 describe. Organisations that had invested in meeting USAID's specific partner-vetting requirements — building exactly the compliance infrastructure this paper's broader argument says is the scarce resource — received no advantage from that investment when the funding disappeared regardless. If the central risk to Kenyan civil society organisations in this period was existential and donor-side rather than compliance-side, then the policy response this paper's broader argument implies (build compliance infrastructure) addresses a real but, for this specific and consequential episode, secondary risk.

This paper does not have a way to fully reconcile those two readings. Both are true at different grain: the compliance-pressure mechanism described in §2-4 remains real and ongoing for the donors still operating, and the sudden, compliance-independent loss described in this section was, for the specific period this paper covers, probably the larger shock to the sector as a whole. §9's second falsification condition is built to test which reading the evidence eventually supports.

6. Objections I take seriously

"FATF's own recent position undercuts this paper's causal story about Recommendation 8." This is the most serious objection to §2's framing, and it comes directly from reading the primary-adjacent source rather than citing the Recommendation's existence secondhand. FATF amended Recommendation 8 in both 2016 and 2023 specifically to prevent four "unintended consequences" of the standard's misapplication to the NPO sector: de-risking (defined by FATF as financial institutions terminating or restricting relationships with clients "to avoid, rather than manage, risk"), financial exclusion, undue targeting of NPOs, and curtailment of human rights and procedural rights.¹ In other words, FATF's own most recent position is a corrective against exactly the pattern this paper describes donors and banks exhibiting, not a directive producing it. The honest reading is narrower: FATF's designation of the NPO sector as warranting risk assessment created the conditions under which over-cautious, risk-averse behaviour by individual banks and donors became common, and that over-caution has persisted even as FATF itself has repeatedly tried to correct it — which is a claim about institutional behaviour lagging a standard-setter's own guidance, not a claim that the standard-setter currently endorses the behaviour. This paper does not have data measuring how much the 2016 and 2023 amendments have actually changed donor or bank behaviour in Kenya specifically.

"Flux has a commercial interest in this conclusion." Flux builds PBOMaster, which addresses the registration layer this paper's argument treats as a precondition for accessing compliant-donor funding, and AccessWASH, whose field data is used directly in §4. This paper's argument that compliance infrastructure is valuable is close to Flux's own sales pitch. The honest mitigation is narrow: §5's account of USAID's closure, and §6's account of FATF's own corrective amendments, are both independent of Flux and, if anything, complicate rather than flatter a simple "build more compliance software" conclusion — §5 explicitly says that investment in compliance infrastructure specifically would not have protected an organisation from the USAID shock.

"The donor-as-regulator framing may overstate donors' coordination and understate how much of this is just each funder independently managing its own risk." This is a fair restatement of §3's own "not a conspiracy" framing, pressed harder: if no donor is coordinating with any other, calling the aggregate effect "regulation" risks implying an intentionality that is not there. This paper's response is that the word is being used for its effect, not its design — a regime does not need to be designed as a regime to function as one for the organisations navigating it — but the objection is correct that "regulator" is doing some rhetorical work the word does not fully earn if read literally.

7. Limitations, and what this paper does not claim

No dataset tracks which specific due-diligence requirement caused which specific Kenyan organisation's funding loss; none was found or built for this paper.

It does not claim FATF Recommendation 8, on its current text, is a cause of donor over-compliance; §6 states the opposite is closer to true — FATF has twice amended it specifically to correct that pattern.

It does not claim the compliance-pressure mechanism (§2-4) was the dominant donor-relations story for Kenyan civil society in 2025-2026; §5 argues the USAID closure was probably larger, and the paper does not have a way to weigh the two precisely.

It does not claim Kenya's FATF grey-list status as of the 19 June 2026 Plenary is independently confirmed against FATF's own primary page; §2's citation is to converging secondary compliance-industry sources after FATF's own site returned access errors, a limitation registered directly in Appendix B.

It does not claim PBOMaster or AccessWASH measurably change an organisation's odds of securing or retaining donor funding; that would require data this paper does not have, and §6 names Flux's commercial interest in that unproven claim directly.

And it does not claim the USAID closure's effects on Kenyan civil society are fully understood yet; the press-reported figures in §5 are order-of-magnitude and from the immediate aftermath of the closure, not a settled accounting.

8. What would falsify this

Stated as commitments, in decreasing order of how much damage each would do to this paper's claims.

A rigorous study finds Kenyan civil-society funding losses in 2024-2026 are overwhelmingly explained by donor budget contraction and bilateral programme closures (principally USAID's) rather than by compliance or due-diligence failure. That would show this paper's "donor as regulator" framing describes a real but secondary mechanism, and the paper's balance between §2-4 and §5 would need to invert.

Evidence shows the 2016 and 2023 FATF Recommendation 8 amendments have measurably reduced de-risking and over-cautious donor behaviour toward Kenyan NPOs specifically, closing the gap between FATF's stated corrective intent and actual bank/donor practice. That would weaken §6's claim that institutional behaviour has lagged FATF's own guidance, and would require crediting the standard-setting process with more real-world effect than this paper currently does.

Organisations that had specifically invested in meeting USAID's partner-vetting requirements are shown, with real data, to have retained funding or found replacement funding at a materially higher rate than organisations that had not — i.e., the compliance investment was not in fact wasted when USAID closed. That would weaken §5's claim that the USAID shock was compliance-independent, and would restore more force to the narrower framing in §2-4.

A comparable study of a different bilateral donor relationship finds no equivalent instability risk — i.e., USAID's sudden closure is shown to be a one-off political event rather than evidence of a structural fragility in donor dependency generally. That would narrow §5's claim from a general lesson about donor fragility to a specific historical episode, without otherwise damaging the paper's core argument.

Appendix A — Evidence table

Appendix B — Citation register

CITATION-NEEDED — dataset linking due-diligence failures to funding losses. Appendix A row 8. This paper's central mechanism (§2-4) has not been tested against organisation-level data; no such dataset was found or built.

CITATION-NEEDED — relative scale of the two donor-side shocks. Appendix A row 9. §5 and §9's first falsification condition both depend on a comparison this paper cannot currently make with real data.

CITATION-NEEDED — PBOMaster/AccessWASH funding-retention effect. Appendix A row 10. §6 names this directly: Flux has not measured whether its own products change an organisation's odds of securing or keeping donor funding.

Sourcing limitation, not a missing citation: Kenya's FATF grey-list status (Appendix A row 2) is sourced to converging secondary compliance-industry trackers rather than confirmed directly against fatf-gafi.org, which returned a 403 error on every fetch attempt during this paper's research — the same access pattern this programme's register has already noted for Kenya Law and pbora.go.ke. The sources used agree with each other on dates and the number of jurisdictions listed, which is the same standard this programme has applied to other hard-to-fetch primary sources, but it is weaker than reading FATF's own page directly, and is flagged as such here.