Kenya’s banking sector is stepping up its defences against cybercrime. The Central Bank of Kenya (CBK) has unveiled a new facility designed to monitor and respond to digital threats targeting lenders and payment providers.
The Banking Sector Cybersecurity Operations Centre, or BS-SOC, was announced on Monday as part of efforts to enforce the country’s cybercrime regulations and keep pace with a rapidly evolving threat landscape.
“This centre is under the CBK’s Cyber Fusion Unit, and is equipped to provide services such as cyber threat intelligence, incident response, digital forensics, and investigations,” the regulator said in a statement.
The initiative also ties into CBK’s Strategic Plan for 2024–2027. It comes at a time when financial institutions across the region are reporting more sophisticated attacks, often linked to new technologies including artificial intelligence.
A recent CBK survey found that banks remain vulnerable and must raise their investment in cybersecurity to guard against emerging risks. The study, which measured awareness and preparedness, concluded that many institutions still lack the resilience needed to withstand advanced digital attacks.
To address gaps in compliance, the central bank has begun harmonising its existing rules — the Commercial Banks Cybersecurity Guidelines of 2017 and the Payment Service Providers guidelines of 2019. For now, regulated institutions must continue observing both frameworks and are required to report incidents to the BS-SOC within legally set timelines.
The regulator first issued sector-wide guidance in 2017, laying out minimum requirements for banks to manage online risks. Since then, Kenya’s financial system has faced waves of cyberattacks, ranging from phishing schemes to breaches targeting mobile money platforms.
Analysts say the BS-SOC could provide much-needed coordination. By pooling intelligence and offering rapid response capabilities, the hub may help banks share information more effectively and recover faster when breaches occur.
Still, the centre’s success will depend on how quickly institutions adopt its directives and invest in their own defences. As one Nairobi-based banking consultant put it, “Technology alone won’t stop these attacks. Banks will have to change how they think about risk, and make cybersecurity part of their culture.”
For the CBK, the message is clear: the cost of inaction is too high. In its statement, the bank said it believes the new installation will “enhance the resilience of the banking sector against persistent cybersecurity threats.”
About the Author
