KenyaNational Payment System Regulations, Security of Payment Services and Annual System Security Audit
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Reporting
As of .
What it requires
- This binds a payment service provider authorised by the Central Bank of Kenya under the National Payment System Act and these Regulations (reached by declaring that you are a payment provider).
- Establish adequate operational arrangements for your payment services that include measures to ensure the safety, security and operational reliability of the service, including contingency arrangements (regulation 27(1) and (2)(d)).
- Within three months of 31 December of every year, submit to the Central Bank of Kenya a system security audit report on your payment services by a reputable independent audit firm (regulation 29(3)(c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Regulation 57's general monetary fine for failure to comply with the Regulations where no specific penalty is prescribed
- Rule
- Fixed only
- As of
- Currency
- KES
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The Central Bank of Kenya, which exercises oversight and supervisory power over a payment service provider, its agents or cash merchants.
What this law does
Regulation 27(1) requires a payment service provider to establish adequate operational arrangements for its payment services. Regulation 27(2)(d) provides that those arrangements include measures to ensure safety, security and operational reliability of the service including contingency arrangements.
Regulation 29(3)(c) requires a payment service provider to submit to the Bank, within three months of 31 December of every year, a system security audit report by a reputable independent audit firm on its payment services. In the Regulations, the Bank means the Central Bank of Kenya.
Regulation 57 allows the Bank, where no specific penalty is prescribed, to impose monetary fines not exceeding one million shillings on a payment service provider, a trustee, an agent or a cash merchant for failure to comply with the Regulations. Regulation 10(1)(e) allows the Bank to suspend or revoke a payment service provider's authorisation if the provider fails to comply with any condition of the authorisation or any applicable Law. The Regulations were published in the Kenya Gazette on and commenced on the same day.
When LexLint raises it
When your app profile says your app is a payment provider.