NAIROBI, Kenya, April 2 – Sacco Societies Regulatory Authority (SASRA) has directed all regulated saccos to implement mandatory data backups and strengthen cybersecurity surveillance ahead of upcoming long public holidays.
In a circular issued to chief executives, the regulator warned that cyberattacks and system breaches are more prevalent during long weekends, particularly in the hours leading up to and during public holidays.
The advisory covers the Good Friday to Easter Monday period from April 3 to April 6, and the Labour Day weekend from May 1 to May 3.
SASRA has now made it mandatory for deposit-taking and non-withdrawable deposit-taking saccos to conduct offline backups of critical data and enhance monitoring of their ICT systems, digital financial channels and management information systems.
The authority also instructed institutions to deploy round-the-clock surveillance systems and response teams to detect and respond to cyber threats in real time.
Particular risk areas flagged include saccos offering services through ATMs, mobile money platforms, internet banking and other digital channels, as well as those relying on third-party vendors and system integrators.
Saccos operating paybill accounts, digital credit products and mobile-linked financial services were identified as especially vulnerable to breaches through external systems.
The regulator further warned institutions to strengthen internal controls to prevent insider collusion, noting that employees working with third parties could facilitate cyberattacks if safeguards are weak.
SASRA added that all third-party engagements must comply with existing regulatory guidelines, cautioning that any losses arising from non-compliant contracts will be borne by responsible sacco officials.
The directive underscores growing concerns over cybersecurity risks in Kenya’s financial sector as digital financial services continue to expand.
