Kenya’s Central Bank Orders Banks and SACCOs to Comply with New Cybersecurity Guidelines

The Central Bank of Kenya (CBK) has rolled out new cybersecurity regulations for banks and Savings and Credit Cooperative Organisations (SACCOs), mandating stricter protection measures for financial systems. At the heart of this initiative is the newly established Banking Sector Cybersecurity Operations Centre (BS-SOC), designed to enhance threat monitoring, incident response, digital forensics, and overall cyber resilience.

What’s Changing

The BS-SOC forms a key part of CBK’s Strategic Plan 2024-2027 under the Computer Misuse and Cybercrime (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024.  All regulated institutions are now required to:

• Report cybersecurity incidents to the BS-SOC within stipulated timelines.

• Align their internal cybersecurity policies and controls with the new guidelines.

Why It Matters

This move recognizes that banks and SACCOs are often targeted by cyber threats—especially as financial services increasingly move online. Without unified guidelines and a central operations centre, many institutions operate in silos, with varying levels of preparedness. The creation of BS-SOC aims to unify response mechanisms and reduce gaps in incident handling.

Challenges Ahead

While this is a strong step forward, several challenges remain:

• Ensuring all banks/SACCOs, especially smaller institutions, have the technical ability and resources to comply.

• Keeping pace with evolving threats, especially around AI-based attacks or more sophisticated phishing.

• Possible delays in incident reporting and enforcement once guidelines take effect.

Bottom Line

Kenya’s CBK is pushing the banking sector to a new standard of cybersecurity. The BS-SOC and updated regulations could significantly increase resilience—if financial institutions rise to the challenge. Proper implementation will be key to protecting institutions and customers alike in a rapidly digitizing environment.