Kenya: Cloud in Financial
Services

Currently, the banking sector in Kenya is regulated by the Central Bank of Kenya whereas the Insurance Regulatory Authority has regulatory and supervisory mandate over the insurance sector. The Capital Markets Authority supervises, licenses, and monitors the activities of market intermediaries including the stock exchange and the central depository and settlement system.⁴

The Draft Financial Markets Conduct Bill, 2018 proposes to establish a Financial Markets Conduct Authority, a Financial Sector Ombudsman and a Financial Sector Tribunal.

Yes, cloud services are in principle permitted and regulatory approval is not required. There is a general requirement for institutions to ensure that third-party service providers of cloud services comply with the applicable legal and regulatory frameworks as well as international best practices. In addition, risks arising from the use of cloud services would be considered to be technology risks and there is a general requirement for institutions to have in place processes of risk assessment and management.⁵

Although cloud services are in principle permitted, specific aspects of the regulatory regime should always be carefully considered to ensure both cloud provider and cloud user compliance based on specific use cases and cloud architecture.

There is presently no specific legislation governing the provision of cloud services in Kenya. There are however Guidelines and Regulations that would be relevant with respect to the provision of cloud services.

Within the banking sector, a Kenyan bank’s move to the cloud will likely have to pay attention to:

1. The Central Bank of Kenya Guidance Note on Cybersecurity:⁶ Institutions are required to comply with a number of measures in respect of outsourcing arrangements. In this regard, institutions are required to have in place adequate governance of outsourcing agreements including due diligence on prospective service providers, documented outsourcing agreements and adequate monitoring of service delivery. In addition, Institutions should ensure that all outsourcing contracts require service providers to comply with applicable legal and regulatory frameworks. Further, vendors should be selected based on compliance and risk assessments and any Service Level Agreements entered into should have robust provisions in relation to security, service availability, performance metrics, or penalties; and
2. banker-client confidentiality rules: A bank must maintain client confidentiality in respect of customer information. Banking secrecy covers information relating to the customer's account, the customer's transactions with the bank and information relating to the customer acquired through the keeping of his account. The duty to respect privacy and confidentiality is expressly recognised in the Banking Act, Cap 488 of the Laws of Kenya.

Board of directors of market intermediaries regulated under the Capital Markets Act are required to oversee the development and implementation of a process of risk assessment and management.⁷

There are no Regulations or Guidelines governing the use of cloud services by insurance companies.

Generally approval is not needed. The provision of cloud services is not regulated and as such the terms under which such services would be provided would be contained in the agreements entered into between the parties.

Banks are required to engage external consultants with sufficient cybersecurity expertise to assist in understanding their cyber threat landscape. In addition, they should carry out an independent cyber threat test at least once a year⁸. In this regard, there should be a collaborative approach between the internal audit, risk management, and external audit functions of an institution.

Banks are also required to undertake due diligence on prospective service providers, documented outsourcing agreements and adequate monitoring of service delivery.⁹ Furthermore, banks are required to monitor contracted third parties for changes in their business and cyber posture including expansions, divestitures, breaches, and new attacks that may alter the third parties’ exposure.

A bank or insurance company which has issued securities to the public is required to conduct a legal and compliance audit on a periodic basis.¹⁰ The board of such an entity is required to ensure that save for when the independent legal and compliance audit is carried out, an internal legal and compliance audit is carried out on an annual basis, with the objective of establishing the level of adherence to applicable laws, regulations, and standards.

At present, there are no restrictions on the transfer of data outside Kenya. However, the draft Data Protection Bill, 2018¹¹ contemplates possible future restrictions on the flow of personal data outside Kenya save in specified circumstances, such as where:¹²

1. the third party is subject to a law or agreement that requires the putting in place of adequate measures for the protection of personal data;
2. the data subject consents to the transfer;
3. the transfer is necessary for the performance or conclusion of a contract between the agency and the third party; and
4. the transfer is for the benefit of the data subject.

Microsoft holds itself accountable to and is subject to laws of general application applicable to information technology service providers, and has binding agreements which, in its view, will likely constitute adequate measures. In addition, Microsoft adheres to the EU Model Clauses as well as the EU Privacy Shield and the ISO 27018 Privacy Standard. Microsoft is also committed to ensuring compliance with the EU General Data Protection Regulation (GDPR) which came into force in May 2018.