Financial regulators warn over reliance on few tech providers

The country’s top seven financial watchdogs have warned that the financial sector's growing reliance on a handful of third-party technology providers poses a serious risk to the national economic stability, as a single point of failure could disrupt services across multiple institutions and the wider economy. 

The watchdogs who include the Central Bank of Kenya (CBK) and the Capital Markets Authority (CMA) in a communique released after their annual Joint Financial Sector Regulators Forum held in Naivasha, warned that the concentration of key services with a few external tech firms requires urgent official scrutiny and subsequent overhaul to prevent a catastrophic failure in the financial system.

Systemic risk refers to the risk of a complete breakdown of an entire financial system rather than the failure of individual parts, which then has severe adverse consequences for the overall economy. 

A core element of systemic risk is the "domino effect," where the failure of one institution or market triggers the failure of others that are otherwise sound.

The regulators who also include insurance and pensions watchdogs, said they agreed to immediately make "mapping of concentration risk associated with third party technology service providers and assessment of risks to the financial system” as “a priority.”

"Reliance on third party technology service providers is a major source of risk, especially if a single service provider serves many institutions," the communique stated. "In the event of failure, the operations of many institutions are likely to be compromised."

Kenya is globally lauded for its fintech innovation, notably the mobile money service M-Pesa, which has created a deeply interconnected digital financial ecosystem.

M-Pesa for instance, accounts for about 99.9 per cent of the value of mobile money transactions, underlining the entrenchment of the platform in Kenya’s economy.

The National Treasury, in its earlier reports warned that the collapse of the M-Pesa service would cause widespread disruption in the economy.

This means M-Pesa is classified as a systemic risk to the country’s economy, underlining its crucial role.

Many lenders have rolled out digital banking platforms, which have cut the need for customers to visit brick-and-mortar outlets for services such as opening accounts, balance inquiries, and settling bills.

Over 400,000 businesses currently use Safaricom's Lipa na M-Pesa service.

In their latest statement, the seven regulators noted that the flip side of efficiency gains from digitalisation is vulnerability to disruptions with a few critical tech vendors providing everything from cloud storage and data processing to payment platforms.

The forum, which also included the Insurance Regulatory Authority (IRA), the Retirement Benefits Authority (RBA), the Sacco Societies Regulatory Authority (SASRA), and the Kenya Deposit Insurance Corporation (KDIC), represents the full spectrum of Kenya’s financial regulators.

Their warnings follow similar concerns in other parts of the world which have prompted a global regulatory shift. 

For instance, the European Union's new landmark Digital Operational Resilience Act (DORA), which came into force this year imposes strict and harmonised requirements on financial firms to manage risks from their critical tech providers and requires thorough exit strategies to switch vendors if needed.

The Bank of England and other leading global regulators have also subjected the financial sector’s reliance on external cloud providers to intense scrutiny, pushing for greater oversight.

In 2021, an outage at US-based cloud service provider Fastly disrupted major websites around the world for about an hour, demonstrating the interconnected nature of the modern internet.

Another major incident was the 2012 collapse of US brokerage Knight Capital Group. 

A software glitch related to a common trading system led to Sh59.3 billion ($460 million) in losses in less than an hour, effectively bankrupting the firm and requiring a forced rescue. 

Previous outages of mobile money systems of local telecom giants in Kenya have triggered disruptions in banking and commercial services, threatening the economy as a whole. 

The communique noted that the innovations have "enhanced access, improved efficiency, and improved the customer experience," but conceded that they "have also introduced a new financial stability, regulatory and consumer protection risks, which need closer monitoring."

The regulators said they will also develop a formal strategy for emerging technologies like artificial intelligence and machine learning. 

They also agreed to align their crisis management and resolution frameworks with international best practice. 

This includes provisions of Emergency Liquidity Assistance for distressed financial services providers and ensuring adequate resolution funds to protect customers, aiming to shore up public confidence.

Their communique was issued after a meeting in Naivasha held under the theme of “Fostering Financial Stability and Resilience Amid Emerging Risks and Regulatory Reforms."