- Kenyan bank accounts are at risk. Kenya lost about $175million last year to cyber crime.
- The Serianu 2016 Kenya Cyber security Report, which highlighted that about 44% of financial institutions run on a cyber security budget of $1-1,000 annually.
- With the increased terrorist activities within Kenya, the Internet presents national enemies such as the Al-Shabaab and other extremist groups with a unique and ubiquitous opportunities.
- There is no existing comprehensive data protection regulation in the jurisdiction of Kenya.

Kenya has been widely celebrated as one of the foremost innovators around the question of financial inclusion. With the acclaim of being the leading nation in the adoption and use of mobile banking platforms such as M-PESA and Equitel, numerous fintech start-ups are opening office in the Silicon Savannah.
In Kenya, the effect of innovation by fintech companies has been brilliantly positive. Per a 2016 Finaccess Household Survey endorsed by the Central Bank of Kenya and the Kenya National Bureau of Statistics, the number of Kenyans formally included by the financial system has grown by 50% in the last ten years.
More than 75.3% of Kenyans are formally banked
Over three-quarters (75.3%) of Kenyans are now formally included, up from 66.8% in 2013. Financial exclusion, which is now down to 17.4%, has more than halved since 2006.
Cyber crime on the rise:
There is no simple way to say this. Kenyan bank accounts are at risk.
The latter statement has been evidenced by the statistics present in the recent Cyber security Report published by Serianu, which asserts that Kenya lost about $175million last year.
Moreover, the Report managed to establish that cyber criminals are deliberately targeting the Kenyan digital economy with the intention of wreaking havoc and making away with millions.
Essentially, in terms of cyber resilience, the Kenyan digital economy can be likened to a slow, plump gazelle stumbling through the “cyber-savannah” in the full view of agile, informed and hungry cyber-predators who have begun to sink their teeth into their sumptuous prize.
Cybersecurity is a budgetary concern
With more than 75.3% of Kenyan citizens formally included in financial services, one would logically expect a correspondent increase in cyber security investments in the financial services sector.
Notably, the Serianu 2016 Kenya Cyber security Report, which highlighted that about 44% of financial institutions run on a cyber security budget of $1-1,000 annually, whilst about 33% of financial institutions in Kenya have $0 spend on all matters cyber security.
Effective infrastructural cybersecurity measures come at a budgetary cost which must be respected by C-Suite executives. The threat landscape is constantly evolving as hackers collectively invest in their own expertise and tools to hack siloed
Financial organisations should staff more cyber security specialists
Notably, 63% of financial organisations in Kenya have an in-house cybersecurity department. However, only 29% of the employees within in-house cybersecurity departments in financial organisations are security certificate holders.
Financial organisations such as banks and fintech companies should ensure that their customers’ data is under the watch of certified cyber security professionals who can:
- Promptly update their security infrastructure to match threat trends,
- Clearly communicate the organisation’s cyber security needs to Board Executives,
- Collaborate with digital product creators to ensure that their consumers enjoy safer technology,
- Train other employees in online hygiene as a safety net against social engineering,
- Swiftly respond to hacking incidences to mitigate losses and collect forensic data for litigation support.
Certified security specialists are a key asset for any financial organisation, as they not only guarantee their organisations’ business continuity by perpetuating trust and reliability of financial products, but also as business enablers who can assist in ensuring that there is security by design in the creation of new financial products.
Immature Data Protection Regulation:
There is no existing comprehensive data protection regulation in the jurisdiction of Kenya. This is in vast contrast to other thriving digital economies such as South Africa, states within the European Union and Canada.
One of the impactful consequences of poor data protection is the immensely secretive way through the occurrence of breaches is treated.
Financial institutions are not necessitated by any law to proactively inform the public regarding any substantial data breaches that have occurred to the detriment of their consumers.
This contrasts with the impending General Dara Protection Regulation in Europe, the Protection of Personal Information Act of South Africa and the Digital Privacy Act (whose adoption introduced mandatory notification via an amendment in the Personal Information Protection and Electronic Documents Act) who urge that any data breach that may result in a risk to the rights and freedoms of individuals should be reported to the relevant supervisory authority.
If unaddressed such breaches can have significant detrimental effect on individuals, i.e, discrimination, damage to reputation, financial loss, loss of confidentiality or any other significant economic or social disadvantage.
Under the Constitution of Kenya 2010, Kenyans’ consumer rights as well as the right to privacy has been asserted as a fundamental right that should be protected by the full legislative might of the Government.
Innovative legislators should get to work to protect the economy of the Republic of Kenya.
Conclusion
Large banks, microfinance institutions even cutting-edge fintech firms have been taking hooks to the jaw thrown by hungry cyber criminals who can see the vulnerabilities present within Kenya’s financial ecosystem.
The reputational harm to the financial sector has been immense as confidence in new, innovative financial products continues to decline sharply.
The finance market runs on the foundational principal of user trust. If financial institutions in Kenya do not champion the cyber security agenda, share threat intelligence to develop a fresh, synergised approach to cybercriminals, those heavy blows to their infrastructure will continue to wreak havoc to their stellar brands.