Is a payment provider, in Kenya

National Payment System Regulations, 2014 (Legal Notice No. 109 of 2014), reg. 29(2)(c) · Read the law's page

• This binds a payment service provider authorised by the Central Bank of Kenya under the National Payment System Act and these Regulations (reached by declaring that you are a payment provider).
• Within ten days of the end of every calendar month, submit to the Central Bank of Kenya, in the form set out in the Fifth Schedule, information regarding material service interruptions and major security breaches, together with the other matters regulation 29(2) lists (regulation 29(2)(c)).

National Payment System Regulations, 2014 (Legal Notice No. 109 of 2014), regs. 27(2)(d) and 29(3)(c) · Read the law's page

• This binds a payment service provider authorised by the Central Bank of Kenya under the National Payment System Act and these Regulations (reached by declaring that you are a payment provider).
• Establish adequate operational arrangements for your payment services that include measures to ensure the safety, security and operational reliability of the service, including contingency arrangements (regulation 27(1) and (2)(d)).
• Within three months of 31 December of every year, submit to the Central Bank of Kenya a system security audit report on your payment services by a reputable independent audit firm (regulation 29(3)(c)).

Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40 · Read the law's page

• Immediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
• Include in the report a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance that would delay or prevent telling them.
• This binds any person who operates a computer system or a computer network in Kenya, whether public or private; the duty is not limited to a critical-infrastructure operator, a licensed entity, or a business of any minimum size, and it binds a government body as well as a private one.
• Failing to make this report is itself an offence: a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both; the Committee may separately propose isolating a suspected system pending resolution.
• This duty is in effect now and has applied since the Act commenced on 30 May 2018; the Computer Misuse and Cybercrimes (Amendment) Act, 2025 left this section unchanged.