Kenyan draft payment bill would make providers report data breaches and stolen funds to CBK at once

Payment service providers in Kenya, including M-Pesa and Airtel Money, would have to notify the Central Bank of Kenya (CBK) of a material event "immediately after the material event occurs" under the draft National Payment System Bill, 2026, Business Daily reported on 4 October. Public comments on the draft close on 9 October.

Material events under the draft include a significant data breach or cybersecurity incident, a prolonged or systemic service outage affecting payment processing or settlement, and the loss of, unauthorised access to or misappropriation of customer funds. A provider that fails or refuses to report, or gives false information about the event, would be liable to administrative enforcement action by the CBK.

The National Treasury and the CBK published the draft and opened it for public comment on 22 September, Techweez reported that day. Techweez described the duty as a requirement to "report serious problems to CBK immediately, including stolen or compromised customer funds, service outages, cyberattacks, data breaches, liquidity problems, and any sign the company might be heading toward insolvency".

The draft would replace the 2011 National Payment System Act, Kenyans.co.ke reported on 22 September. Existing payment companies would have one year from the date the law takes effect to meet all the new requirements, according to Techweez.

Techweez reported that the CBK is holding public forums on the draft between 28 September and 9 October in towns including Mombasa, Kisumu, Nakuru, Nyeri, Meru, Kitale and Nairobi.

In the European Union, payment providers are required to report major operational or security incidents within four hours of classification, or within 24 hours at most of becoming aware of an incident.