CBK Cybersecurity Guidance for Banks and Payment Service Providers

Who the guidance applies to

CBK's banking guidance applies to the commercial banks it supervises, and its payment service provider guidance applies to institutions licensed to provide payment services. Other regulated entities, such as microfinance banks, may be covered by related CBK requirements. If you are a fintech without a CBK licence, the guidance still shapes your obligations, because the banks and licensed PSPs you work with must manage the risk you introduce and will pass expectations down to you through contracts and questionnaires.

Governance: the board owns cyber risk

A consistent theme is that cybersecurity is a board-level risk, not an IT matter. Supervisors expect a board-approved cybersecurity strategy or policy, a senior officer accountable for it, and regular reporting to the board that shows the board actually engaged with the risk.

The evidence that convinces is specific: minutes where the board discussed test findings or an incident, a policy that has been reviewed recently, and a named person with the authority to act.

Testing and monitoring

Institutions are expected to test their systems and controls independently and regularly, and to monitor for attacks rather than relying on prevention alone. For most institutions that means periodic penetration testing of internet-facing systems, mobile apps and APIs, regular vulnerability assessment of internal systems, and continuous monitoring through an in-house or managed security operations centre.

What matters to a supervisor is the cycle, not the report. A penetration test whose critical findings are still open six months later is evidence of a control failure, not of compliance. Track every finding to closure and retest it.

Incident response and reporting

The guidance expects an incident response plan that has been tested, and requires significant cyber incidents to be reported to CBK within the timelines it sets. Know in advance how you classify an incident, who decides whether it is reportable, and who sends the report.

Remember that a cyber incident involving customer data is usually a personal data breach as well, with its own 72-hour notification duty to the Data Commissioner under the Kenya Data Protection Act. Plan both reporting tracks together.

Third parties and outsourcing

Cloud providers, core banking vendors, card processors and fintech partners all extend your attack surface. Institutions are expected to assess vendors before engaging them, set security obligations in contracts, and monitor critical suppliers over time. Ask critical vendors for their own recent independent test results and certifications, and make sure contracts give you incident notification and the right to have their service tested.

Building an evidence pack

Whether the question comes from a supervisor, an auditor or a bank partner, the same small set of documents answers most of it. Keep them current and in one place.

• Board-approved cybersecurity policy and the name of the accountable officer.
• A current cyber risk register.
• The latest penetration test and vulnerability assessment reports, with remediation status.
• Monitoring coverage and the last few months of incident records.
• The incident response plan and the date it was last exercised.
• Vendor risk assessments for critical suppliers.
• Staff awareness training records.

Key takeaways

• CBK has issued cybersecurity guidance for banks and for payment service providers; read the current version for your licence.
• Its themes are governance, risk assessment, protection, testing, monitoring, incident reporting and third-party risk.
• Supervisors and partners want evidence: board minutes, test reports with closed findings, monitoring records and exercised plans.
• Cyber incidents involving customer data usually trigger 72-hour breach notification under the Data Protection Act as well.
• Fintechs without a CBK licence meet the same expectations through bank and PSP partner due diligence.

Frequently asked questions