When a private company’s neural nets began to unmask the hidden flows inside M-Pesa, the discovery jolted more than the fintech sector — it forced Kenya to confront a systemic question: who watches the watchers, and on what rules? The rollout of AI-driven compliance tools at Safaricom was never merely a tech upgrade; it arrived as part of a national emergency — a response to international pressure, spiralling fraud, and regulatory failure. The Financial Action Task Force’s increased-monitoring designation and months of global scrutiny had already pushed lawmakers and regulators into a sprint of reforms; industry actors answered with models that could learn patterns humans could not. But those same models required data — vast, granular, and often personal — and the legal scaffolding for such access was changing in real time. Kenya’s recent cyber-law overhaul and parliamentary amendments to the Computer Misuse and Cybercrime Act expanded state powers over online infrastructure, tightened penalties for SIM-swap and phishing offences, and gave the National Computer and Cybercrimes Coordination Committee sweeping directive authority over platforms and applications. Those moves addressed real harms — SIM swap fraud, phishing, and mass laundering — but they also recalibrated the balance between surveillance and rights.
That recalibration is tested in the day-to-day rub of enforcement. Regulators and the ODPC have begun to draw lines: the Data Protection Commissioner’s recent ruling against a major betting operator for excessive data demands underscores the point that AML objectives cannot be a carte blanche for limitless intrusion. In the Betika case the ODPC found the company’s demand for three months of a user’s M-Pesa statements at account-closure to be disproportionate and ordered compensation, signalling that data-minimisation and privacy remain legally enforceable even amid AML pressures. At the same time, FATF’s 2025 monitoring guidance — and independent analysis from ISS Africa — make plain that Kenya must also show measurable results in prosecutions, beneficial-ownership transparency, and risk-based supervision of non-financial entities (including gambling and virtual assets) if it is to repair global confidence. The practical implication is blunt: Kenya cannot satisfy international partners by papering laws alone; enforcement and proportionate procedural safeguards must accompany technical surveillance. Otherwise the country risks swapping one reputational problem (grey-listing) for another — a domestic legitimacy crisis born of heavy-handed data practices.
So where does Kenya go from here? The answer lies in design choices — legal, technical, and institutional — that make accountability a feature, not an afterthought. We recommend three urgent, interlocking reforms that turn the AI question into a governance opportunity: (1) Purpose-bound, time-limited data access. AML or security queries should be scoped narrowly and logged; full transaction histories must not be a default feed into private models. (2) Explainability + redress. Any automated decision that materially affects a person (account freezes, cash-outs blocked, KYC escalations) must carry a succinct, non-technical rationale and a fast appeals channel routed through an independent body. (3) Joint independent oversight. Operationalize a statutory ODPC–FRC technical review board with public reporting obligations, the power to audit both models and data requests, and a mandate to publish redaction and retention metrics. These are not frictionless reforms — they will slow some processes and impose costs — but that trade-off is precisely the point: legitimacy costs less than lost trust. If Kenya stitches these protections into law and practice — and couples them with meaningful prosecution of financial crimes and improved beneficial-ownership registers — it can convert the awkward moment of global scrutiny into a first-mover advantage: an African model of rights-based, explainable AI governance for financial systems. The choices made now will decide whether Kenya’s algorithms become instruments of accountability or mechanisms that hollow out public trust.
References:
Business Daily Security or surveillance? How amended cyber law could reshape Kenya’s online space
Daily Nation How AI can close trust gaps in Africa’s financial systems
The Kenyan Wall Street How Safaricom is Leveraging AI to Bolster M-Pesa Security and Efficiency
Business Daily What FATF grey-listing means for Kenya




