Kenyan banks are tightening their oversight of third-party technology service providers (TSPs) following rising cases of cyber threats and data breaches linked to outsourced partners, a new Central Bank of Kenya (CBK) survey shows.

Lenders are taking a more cautious approach in selecting these firms, revising contracts and strengthening monitoring systems to reduce risks that have led to financial losses and regulatory challenges.

According to the CBK, financial institutions are moving away from one-off evaluations and adopting continuous oversight frameworks that match evolving risk priorities and technological changes.

The heightened scrutiny comes as banks report concerns over vulnerabilities introduced not just by the tech providers themselves, but also by the outsourced firms’ own clients.

Third-party providers play a key role in banking operations, offering services such as mobile and internet banking application development, cloud storage, artificial intelligence tools, payment aggregation, credit scoring, anti-money laundering systems, fraud detection, and cybersecurity solutions.

However, the CBK survey revealed that these engagements are increasingly coming with challenges.

“Financial institutions face a number of challenges when engaging third-party TSPs, including but not limited to high costs of third-party services, adaptability and response to new requirements, limited visibility into subcontractors, longer response times to fix issues, and delayed response to incidents or breaches,” the CBK noted.

Cybersecurity and data privacy risks were highlighted as the most pressing issues, with over 70 percent of banks citing them as their top concerns.

Official figures show that cybercrime attacks targeting Kenyan institutions more than doubled in the year to June 2025.

Data from the Communications Authority indicates that detected threats surged by 146 percent to 8.6 billion, up from 3.5 billion in the previous year.

The CBK survey also found that 26 percent of lenders lack sufficient mechanisms to monitor their technology service providers. Other reported hurdles include regulatory and compliance difficulties and vendor lock-in, where switching providers becomes costly and complicated.

In response, many banks are deepening due diligence during the selection of partners, introducing more robust contract terms, and enhancing surveillance of outsourced activities.

They are also conducting joint disaster recovery drills and security audits to strengthen preparedness.

“Evaluating a vendor’s technical capacity, financial stability, regulatory compliance, and cybersecurity posture must go beyond basic checklists and include in-depth assessments, joint disaster recovery drills, and security audits,” the CBK said, reflecting lenders’ feedback.

The revised contracts now include stronger data protection clauses and clear termination procedures aimed at preventing disputes and reducing operational and legal risks.

Banks say these measures are necessary to keep pace with emerging cyber threats and safeguard customer data in an increasingly digital financial sector.