SACCOs Told to Treat Technology as a Board-Level Risk
SASRA’s draft ICT guidelines would tighten board control over vendors, systems and members’ data. Stakeholders have until November 30th to submit comments and views on Draft Guidelines on Information, Communication and Technology for Regulated SACCO Societies.
When a SACCO member taps a phone to check savings or apply for a loan, a core system, a vendor’s servers and a payment gateway work unseen. Few boards have complete oversight of that chain. The Sacco Societies Regulatory Authority (SASRA) wants to change that.
The regulator has drafted Guidelines on Information, Communication and Technology for Regulated SACCO Societies. They target stronger ICT governance, cybersecurity, protection of members’ data and reliable digital services. According to SASRA, the aim is a common minimum standard for governing, acquiring, operating and controlling technology across the subsector.
Accountability at the top
The rules apply to regulated SACCOs, any entity performing an ICT function on their behalf, and all ICT resources, whether owned, leased, hosted, shared or consumed as a service. Issued under the Sacco Societies Act, they yield to the Act and other written law in any conflict. The board, supervisory committee, chief executive and all officers would be held individually and jointly responsible for compliance.
Directors must understand the SACCO’s reliance on technology, set its ICT risk appetite, approve strategy and fund it adequately. ICT becomes a standing board agenda item, a board committee takes oversight, and a qualified officer runs the function daily. Management must set up a steering committee, maintain an inventory of critical processes and information assets, enforce change management and access controls, and report material incidents to SASRA. Outsourcing, the draft stresses, does not transfer accountability.
Buying and migrating systems
No SACCO could acquire or upgrade a core system, change its database or vendor, or launch or alter a digital channel without SASRA’s prior written approval. Channels include USSD, apps, ATMs, PesaLink and agency services. Approval must be sought before procurement, backed by a board-approved business case.
Migrating years of member records requires a documented Data Migration Plan. Data must be classified, fields mapped, testing done in controlled environments and reconciliation completed before go-live.
What a core system must do
Minimum standards include one unique record per member, with duplicate detection and ID checks against the Integrated Population Registration System (IPRS). Systems must keep separate ledgers for share capital and non-withdrawable deposits, apply loan affordability rules automatically and track guarantors in real time. Modules must post to accounting immediately, products must be configurable without code changes, and test and production environments must be separate. Capacity must reach at least twice average daily volume to withstand month-end peaks.
Vendors under scrutiny
Vendors must disclose material changes in ownership or finances, report security incidents, follow a framework such as ISO/IEC 27001 and enforce multi-factor authentication for privileged access. They may not touch live systems without the SACCO’s authorisation.
On data, the draft is unambiguous. Member, transaction and operational data remain the SACCO’s property, may not be commercialised and may not be withheld in a payment dispute. Vendors must allow export in usable formats, with no proprietary lock-in.
SACCOs carry duties too. They must conduct due diligence before engagement and periodically afterwards, review performance against service levels, keep exit strategies and ensure foreign vendors keep technical staff in Kenya.
Cybersecurity and AI
Boards must receive cybersecurity reports at least quarterly and undergo annual awareness training. Chief executives must appoint an information security officer independent of daily ICT operations. Every cybersecurity incident must reach SASRA within 24 hours of detection. SACCOs must run annual risk assessments and commission an independent information systems audit before expanding digital services.
Emerging technologies are permitted, but only after assessing business value and cyber, data protection, legal and reputational risks. For artificial intelligence, the draft requires approved purposes, testing, records of material systems and a person able to override decisions affecting members. Staff may not enter confidential member information into public AI tools. Member data must be stored in compliance with Kenyan law.
