Sacco Cybersecurity in Kenya: SASRA, the Data Protection Act and Where to Start
What SASRA and the Data Protection Act mean for Sacco cybersecurity, the threats Saccos actually face, and where a small IT team should start.
· Reviewed by Danstan Akwiri, CISSP, CISA
Saccos hold their members' savings, loan histories, national ID numbers and phone numbers, and increasingly offer mobile loans, M-Pesa deposits and withdrawals, and online statements. Every one of those services is also a route for fraud. For a member-owned institution, a security failure is not only a financial loss: it is a breach of the trust the whole society is built on.
This guide explains the obligations a Kenyan Sacco works under, the threats that actually cause losses, and a practical order in which to address them when the IT team is one or two people and the budget is modest. It is written for boards and management as much as for IT.
| Threat | How it usually happens | First control |
|---|---|---|
| SIM-swap and account takeover | A fraudster takes over a member's phone number and resets access to mobile banking | Extra verification for number changes and new devices; alerts to members |
| Fake payment instructions | An email or call impersonating a manager or supplier asks the finance desk to pay | Call-back verification on a known number before any new or changed payment |
| Insider misuse | A staff account with broad access is used to alter loans or move funds | Least-privilege roles, maker-checker on transactions, and reviewed audit logs |
| Weak integrations | An M-Pesa callback or loan API accepts requests it should reject | A penetration test of mobile and payment channels before and after changes |
| Ransomware | A phished workstation spreads to the core system and backups | Offline, tested backups and endpoint protection on every machine |
What SASRA expects
The Sacco Societies Regulatory Authority licenses and supervises deposit-taking Saccos under the Sacco Societies Act, and its oversight has been extended to specified non-withdrawable deposit-taking Saccos. SASRA's focus is that a regulated Sacco is soundly governed and manages its risks, and once a Sacco runs digital channels, technology and cyber risk are part of that.
In practice that means the board should be able to show that it understands the Sacco's technology risks, that policies exist and are followed, that systems are tested and monitored, and that incidents are handled and reported. Check the current SASRA circulars and guidelines that apply to your category of Sacco for the specific expectations, and treat them as a minimum rather than a target.
What the Data Protection Act adds
Member records are personal data, so the Kenya Data Protection Act, 2019 applies to how a Sacco collects, uses, shares and secures them. That includes having a lawful basis for processing, telling members how their data is used, registering with the Office of the Data Protection Commissioner where the thresholds apply, applying appropriate security safeguards, and notifying the Data Commissioner within 72 hours of becoming aware of a breach that puts members at real risk.
Data protection and security are not separate projects. A Sacco cannot meet its data protection duties if staff share logins, if member data is exported to spreadsheets and emailed around, or if nobody can tell from the logs who viewed a record.
Where to start: a practical order of priorities
With limited people and budget, sequence the work so that the controls that stop the most common losses come first.
- Train staff who handle payments and member requests to recognise social engineering, and introduce call-back verification for any new or changed payment instruction.
- Remove shared logins, give each staff member a role with only the access they need, and turn on two-factor authentication for email and the core system.
- Make sure backups are offline or immutable, and test restoring them. A backup that has never been restored is a hope, not a control.
- Commission a penetration test of the channels members use: the mobile app, member portal, USSD and M-Pesa integrations.
- Map member data, confirm ODPC registration status, and write a short breach response procedure.
- Report to the board quarterly in plain language: the top risks, what changed, and what is planned.
The board's role
Boards do not need to be technical, but they do need to ask the right questions and expect evidence in return. Useful questions include: when were our member-facing systems last independently tested, and were the findings fixed? Who can approve a payment, and what stops one person doing it alone? How quickly could we restore the core system after ransomware, and when did we last try? What would we tell members, SASRA and the ODPC if member data leaked tomorrow?
Board members are also targets themselves, through impersonation and fake instructions that use their authority. Short, practical training for the board pays for itself.
Working with vendors
Most Saccos rely on a core banking or Sacco management system vendor, plus integrators for mobile and M-Pesa. Your obligations do not transfer to them. Contracts should cover security responsibilities, access to logs, breach notification to you within a defined time, and permission to have the system tested. Ask vendors for their own recent test results, and test the integrations they built for you.
Key takeaways
- SASRA expects regulated Saccos to manage their risks, and technology risk is part of that once you run digital channels.
- The Kenya Data Protection Act applies to member data, including security safeguards and 72-hour breach notification.
- Most losses come from social engineering, weak access control and untested channels, not sophisticated attacks.
- Start with staff training and payment verification, then access control, tested backups and a penetration test of member channels.
- Boards should ask for evidence: test reports, fixed findings, restore tests and a breach plan.
Frequently asked questions
Does SASRA require Saccos to have a penetration test?
SASRA expects regulated Saccos to identify and manage their risks, including technology risk. A penetration test is how a Sacco gets independent evidence that its mobile, portal and payment channels resist attack. Check the current SASRA guidance for your category for any specific testing expectations.
We use a vendor's core system. Isn't security their responsibility?
Partly, but the Sacco remains accountable to its members, SASRA and the ODPC. Your contracts should set out the vendor's security duties, and you should still control staff access, verify payments and test the integrations built for you.
What is the single most effective first step?
Training the staff who handle payments and member requests, combined with call-back verification for payment instructions. Those two measures stop the frauds that most often cost Saccos money.
How should we report cybersecurity to our board?
Quarterly, in plain language: the top five risks, incidents and near misses, test results and whether findings were fixed, and what is planned next. Avoid tool names and technical jargon.