Kenya: CBK Says Bank Boards to Pay for Cybercrimes

The Central Bank of Kenya (CBK) has issued new rules to payment service providers including commercial banks and technology companies warning the boards of directors that they face "ultimate" liability in case of criminal breaches.

In the guidelines aimed at stemming cybercrime, the CBK says boards will take responsibility for breaches of customer information.

"Payment Service Providers (PSPs) should carry out regular independent assessment and audit functions that shall be undertaken by the internal and external audit and risk functions ... The board of directors is ultimately responsible for the cybersecurity of the PSP," said CBK.

PSPs including firms like Mastercard, Visa, Safaricom, Airtel and Telkom who have 90 days to comply with the requirements published this month.

Firms working with PSPs are also expected to treat customer information confidentially.

"Outsourcing agreements should be governed by a clearly written contract, the nature and detail of which should be appropriate to the materiality of the outsourced activity in relation to the ongoing business of the PSP," says the policy.

"Some of the key provisions of the contract include controls to ensure customer data confidentiality and service providers' liability in case of breach ... "

Some financial institutions are required to collect detailed customer information for anti-money laundering, tax and accounting reasons.

Privacy experts around the world have recently expressed concerns about how personal data is collected and used by companies.

In April, the government approved a tough policy on data protection, paving the way for it to be tabled in Parliament.

See What Everyone is Watching

More From: Nation

Don't Miss

AllAfrica publishes around 700 reports a day from more than 140 news organizations and over 500 other institutions and individuals, representing a diversity of positions on every topic. We publish news and views ranging from vigorous opponents of governments to government publications and spokespersons. Publishers named above each report are responsible for their own content, which AllAfrica does not have the legal right to edit or correct.

Articles and commentaries that identify as the publisher are produced or commissioned by AllAfrica. To address comments or complaints, please Contact us.