ELECTRONIC PAYMENT SYSTEMS

A CRITIQUE OF THE LEGAL ASPECTS AND REGULATORY FRAMEWORK IN KENYA

BY
VAYONDA SIRMA
AND
HENRY OGUTU
LECTURER: DR. DAVID GACHUKI
ABSTRACT
This paper seeks to investigate the impact and implications of Kenyan legislation on electronic payment
services; which are increasingly being adopted by consumers of banking services as the preferred mode of
effectuating payment. It discusses the various forms of electronic payments; their legal and regulatory
framework; and the consumers privacy and security concerns. The investigation reveals that not only does
the legal and regulatory framework not provide sufficient safeguards for consumers but also that it does
not clear up the ambiguities arising from a combination of rapidly changing technologies and the !urisdiction
ambiguities regarding the responsibilities of the different sector players. "oreover electronic payment
services #as they are based on technologies designed to e$tend the geographical reach of banks and
customers% e$pose both customers and banks to legal risks associated with non&compliance with different
national laws and regulations including consumer protection laws record keeping and report re'uirements.
(ur study reveals that the current and proposed law do not address the multitude of these issues.
)
CHAPTER ONE
FORMS OF ELECTRONIC PAYMENT SERVICES
INTRODUCTION
*lectronic payment services refer to a cluster of technologies that allow for the electronic e$ecution of
financial transactions without reference to the traditional paper-based settlement modes. +ince electronic
payment services are a new and evolving technology whose full impacts are unknown they have given rise
to a number of concerns , their efficacy privacy systems security and consumer protection , which are the
main issues that this paper focuses on. The main push for electronic payment services by consumers and
banking institutions alike is as a response to the dynamic interaction of the economic environment
increasing consumer sophistication increased participation by thrift industries in the financial services
sector and their cost efficiency. -owever the legal and regulatory framework in respect of these services in
Kenya has not faced up to the increasing consumer&protection challenges that these services evoke. These
challenges can be surmised into privacy and security within conte$t of inade'uate protections afforded by
the law to consumers of banking services.
.oosely defined electronic payment services #/*0+1% consists of a group of technologies that electronically
facilitate financial transactions. "essages sent by several forms of electronic communication cause the
transfer of funds from one financial account to another substituting the direct e$change of currency or
signed che'ues that would bring about the same transfer. The term *0+ has also come to include transfer
of information critical to such transactions without an immediate transfer of funds; for e$ample
authori2ation of credit cards telephone&bill payments or validation of financial transactions by
telecommunication
3
. In Kenya some of these services are decentralized and are provided directly to the
consumer at retail. They consist of transactions that may involve an individual and one or more providers
of financial services. In some cases as in the use of automated teller machines the transfer is immediate.
1
*lectronic payment services can be clustered into decentrali2ed or customer&oriented services and centrali2ed or institutional&
oriented services. 4ecentrali2ed services are further categori2ed into services that facilitate the transfer of information #such as
che'ue and credit authori2ation account status in'uiry che'ue verification% and electronic services that involve direct money
transfer. 5entrali2ed services include direct deposit payroll pre&authori2ed debit services corporate cash management #including
automated clearing houses interbank and intrabank transfers% and interbank settlements and clearings.
6
In others #such as che'ue verification services% value is conveyed by a paper instrument such as a
che'ue while the electronic service provides information to the recipient that funds are being conveyed.
+ometimes the consumer operates a machine that is used to provide an *0+ service whilst in other cases
the consumer gains access to the service through an intermediary.
1.1 AUTOMATED TELLER MACHINES (ATMS)
The most common form of *0+ services that has been readily accepted and used by most consumers of
financial services is the 7T". 8uintessentially they provide the banking services used most often by
consumers #e$cept loans%. "ost transactions can be accomplished faster and more conveniently than with
human tellers and its main attraction is its availability twenty #)9% hours a day
)
. Indicatively 7T"s allow
deposits to and withdrawals from customers accounts transfer between these accounts and accounts
balances 'ueries. They also permit the use of credit cards for cash advances as well as overdraft privileges
for particular customers. 5ash disbursements are usually limited to a predefined amount and the 7T"s
facilitate the daily updating of customers accounts. In most instances the debit card used to activate the
7T" is proprietary to the bank and its usage is effectuated by a personal identification number that is only
supposed to be accessible by the customer card&holder. 7T" networks may be proprietary to one institution
or they may be operated on behalf of multiple institutions by consortia or by third party operators
6
.
1. POINT!OF!SALE (POS)
0(+ is a payment service deployed in supermarkets department stores and other commercial facilities
which offer several kinds of services:
#a% 5redit card authori2ation and validation;
#b% 4irect transfer of funds from a customers accounts to the merchants account by means of a
debit card; and
#c% 5ertain banking services: i.e.; direct withdrawal of currency from #or deposit in% a depository
account using the merchants cash drawer and sales personnel.
2
7lthough customers who rely on this feature are on occasion seriously inconvenienced by finding the machines inoperative at
critical moments.
3
In Kenya these operation platforms are offered by PesaPoint and Kenswitch.
9
0(+ services employ a terminal operated by the merchant and a telecommunication link to customer
information files within banking and financial institutions.
1.". TELEPHONE BILL PAYMENT (TBS)
TB+ services allow customers to pay bills using a home telephone to instruct their banks to transfer money
from their accounts to that of a creditor. It is one of the *0+ services that is being phased out by the rapidly
evolving technology and was widely used in 7merica and *urope in the 3;<=s and 3;>=s. TB+ involved the
recording of the customers verbal instructions on a tape or through the intervention of human operators to
facilitate the processing of the customers instructions. (ne of its ma!or drawbacks was that the customer
had no proof that instructions for payment had been given until he?she had received a monthly statement;
which provided the customers only proof of payment
9
.
1.# WIRE TRANSFER
@ire transfers are the earliest form of *0+ and are chiefly responsible for the transfer of large sums of
money. Its current forms are embodied in the *lectronic Aunds Transfer #/*AT1% and Bapid Transfer Cross
+ettlement #/BTC+1%
D
.
1.$. CREDIT CARDS
4
Thus the customer often found it very difficult to substantiate his claims in case of a dispute in respect of his instructions to the
bank.
5
In Kenya BTC+ is effectuated through the Kenya *lectronic 0ayment and +ettlement +ystem #K*0++%. It was launched on Euly
); )==D in line with the Covernment of Kenya and 5entral Bank of KenyaFs moderni2ation initiatives for the countryFs Gational
0ayment +ystem. K*0++ has en!oyed tremendous growth in its value and volume throughout; attributable to the ever increasing
awareness by the public that K*0++ is a more safe and efficient system for settling high value and time critical payments and
the Covernments decision to stop using che'ues and process all its payments electronically through K*0++ with effect from
Govember )==;.
D
5redit card services are offered by banking and financial institutions to their customers on post-payment
basis for which the customers pay a certain premium on top of what the amounts that they spent through
that card every month. 5redit card authori2ation services are operated by card providers through electronic
terminals to determine whether a card should be honored for a particular transaction or not. There are two
kinds of credit card authori2ation and validation services;
a% Those that have direct access to the customers account #positive files%; and
b% Those that depend on information gathered from a variety of other sources #referred to as negative
files as they contain only information that is used to disallow transactions%. These sources include
records of a customers transactions with the system and data reported by participation institutions
and not on actual records
H
.
1.%. DEBIT CARDS
4ebit cards could be considered as the most successful *0+ in the Kenyan market to date particularly
when coupled with the proliferation of 7T"s networks across the entire country. They are considered as a
convenient substitute to hard currency or che'ues.
1.&. AUTOMATED CLEARINGHOUSES (ACH)
75- comprise a centrali2ed *0+ service that serves institutions rather than individuals. Instead of having
che'ues sorted and physically dispatched to the debiting bank an 75- receives sorts and distributes
payment information electronically which instructs banks to debit and credit accounts at specific times.
1.'. N() S())*(+(,) I,-)./0)12,- (NSI)
6
This type of validation usually through credit reference bureaus is more prevalent in *urope and the I+7.
H
G+I refers to an account transfer involving multiple debits and credits initiated by a J net settlement system
to settle net obligations arising from the conduct of a payment clearing system such as che'ue clearing or
0(+ clearing. Isually G+I is a discretionary operation of the bank without much involvement of their
customers and this portends a gray area when considered in light of the privacy and security concerns.
CHAPTER TWO
PRIVACY3 SECURITY AND LAW RELATING TO ELECTRONIC PAYMENTS SERVICES IN KENYA
INTRODUCTION
<
The principal concerns that have arisen about *0+ relate to the e$tent to which personal data might be
disclosed to third parties by banking and financial institutions the possibility of unwarranted government or
private surveillance through *0+ systems and data files and the right of consumers to see challenge and
correct personal data that might be used to their disadvantage. 0articular concerns abound that with the
increased adoption and use of *0+ consumers privacy will likely to be violated. This is due to the fact that
most of the *0+ services use online terminals making intrusive surveillance a more credible possibility.
"oreover there is a higher risk of dissemination of incorrect or inaccurate data concerning consumers
accounts even if safeguards to correct these inaccuracies are facilitated. "oreover the 5onstitutions clear
recognition of the right to privacy despite a lacuna in the e$isting laws and regulations legitimi2es these
privacy concerns. This necessitates more comprehensive *0+ privacy protection whether through new
legislation modification of e$isting law administrative procedures and regulations and enhanced industry
standards.
+ecurity in respect of *0+ relates to the protection of the integrity of *0+ systems and their information
from illegal and unauthori2ed use. The need for stringent security in *0+ systems has been propelled by
the inherent vulnerabilities in *0+ systems such as:
#a% *0+ systems have many access and terminal points where transactions can be effectuated in
unauthori2ed ways because of direct customer involvement with the dynamics of the system
and the way in which data relating to customers accounts is aggregated and transmitted
between institutions;
#b% *0+ crime is usually difficult to detect because funds?data can be removed by instructions
hidden in comple$ computer software beyond the purview of customers; and
(c) 7rguably *0+ systems reduce the effectiveness of some of the traditional methods of
controlling and auditing access to customers accounts.
7n interview with a senior manager at one of Kenyas commercial banks revealed that *0+ systems
security violations is difficult to assess because there is underreporting of *0+ systems crime a paucity of
information about *0+ systems security and a general lack of informed public discussion. @hile players in
the banking industry feel that there is a danger in e$acerbating these concerns by giving them a higher
visibility through public discussion. Gonetheless the public is entitled to know what risks they are e$posed
in using *0+ services and banking institutions and law enforcement agencies would also benefit by sharing
information about vulnerabilities defense strategies and security&enhancing technologies.
>
.1 PRIVACY AND SECURITY
"uch as it is difficult to define privacy in a precise and concise fashion it could be reduced to the ability to
keep certain kinds of personal information from other people or restrict its use e$cept as one freely
chooses to permit its disclosure or use. The (*54 Cuidelines on 0ersonal 0rivacy states that there may
be many reasons why privacy is such a paramount concern to consumers who may wish to withhold
information about themselves other than their concerns about possible government encroachments on their
civil liberties
<
. 0articularly because information may e$pose them to censure or threaten their reputation
social status , and more so with regards to information concerning their finances.
.1.1 P.14506 5,7 -(0/.1)6 .(*5)1,8 )2 F1,5,015* T.5,-50)12,-
Indeniably only transactions in which currency is the medium of payment can be accomplished with some
degree of anonymity. In *0+ systems privacy is violated when data is without the sub!ects consent made
available to and used by those not a party to the transaction for purposes other than those necessary to
accomplish the transaction. Those other purposes could range from organi2ed market campaigns to
intrusive surveillance to blackmail. If a person has neither e$plicitly nor implicitly consented to disclosure
and use of information for a given purpose personal privacy is considered to have been violated even if the
same information was willingly provided by that person or to the same party for a different purpose.
7dditionally there is also the obverse of unauthori2ed disclosure of information to third parties; namely the
ability of the individual to know what personal information has been collected and how it is being used.
5onse'uently there is the greater concern about privacy in *0+ systems due to the following reasons;
#a% *0+ systems make it easier to collect organi2e store and access large amounts of data;
#b% "ore data are electronically readable and processable making them easier to manipulate and
aggregate; and
#c% The large number of points at which data is retained making it susceptible to unwarranted
access and use by third parties.
7
(*54 Cuidelines on the 0rotection of 0rivacy and Transborder Alows of 0ersonal 4ata #3;>=%
;
The 'uestion of *0+ systems security is closely related to the concerns of privacy. Isers of banking
products want to be assured of the confidentiality of the information relating to their accounts , with the
assurance that it will be aggregated and used only for purposes integral to the payment system and
necessary to the carrying out of the necessary instructions as intended by the customer. This assurance
rests on the confidence both in the intent of the financial institution and in its ability to protect the
information and limit access to the institutions authori2ed agents. If security is breached the institution
cannot provide this protection and the users privacy may be violated. It should also be noted that some
means of increasing security especially through audit trails increase the possibility that privacy may be
infringed because additional copies of data are created at various points in an electronic payment system.
. L(85* 5,7 R(8/*5)2.6 E,41.2,+(,) 29 E*(0).2,10 P56+(,)- S(.410(-
+ection 9 7 3#d% of the 5entral Bank of Kenya 7ct empowers the 5entral Bank of Kenya to formulate and
implement such policies as best promote the establishment regulation and supervision of efficient and
effective payment clearing and settlement systems. In view of this enabling statute the 5entral Bank of
Kenya has directed great effort to the moderni2ation of the payment systems in the last two decades.
Initially the ob!ective of the moderni2ation process was to systematically and continuously implement
policies that would ultimately enable the countrys payment system to attain international standards and
ensure that Kenya becomes a financial hub in the region as well as the preferred investment destination.
The fundamental policy ob!ective for payments moderni2ation was the achievement of safety efficiency and
effectiveness of the countrys payment.
..1. T:( C(,).5* B5,; 29 K(,65 5,7 ):( ;(6 +1*(-)2,(- 1, ):( +27(.,1<5)12, =.20(-- 29 =56+(,)
-(.410(- 1, K(,65
The first milestone of the moderni2ation process was reali2ed in 3;;> with the automation of the Gairobi
5learing -ouse that saw the reduction of the che'ue clearing cycle from fourteen days to four days. This
was facilitated by the adoption of the "agnetic Ink 5haracter Becognition #"I5B% technology and
*lectronic Aunds Transfer #*AT% system.
3=
The second important milestone was the amendment of the 5entral Bank of Kenya 7ct in )==6 that
introduced +ection 97 3#d% into the 7ct which provided a strong basis upon which the Bank could promote
moderni2ation of payment clearing and settlement systems including the continuing innovations in the
retail payment arena.
The third key milestone was the implementation of the K(,65 E*(0).2,10 P56+(,)- 5,7 S())*(+(,)
S6-)(+ (KEPSS)3 the countrys Beal Time Cross +ettlement #BTC+% +ystem in Euly )==D. K*0++
implementation facilitated the mitigation of risks associated with the previous paper&based inter&bank
settlement system; transformed the management of li'uidity in the banking industry; reduced the systemic
importance of the 7utomated 5learing -ouse #75-%; and enhanced financial stability while providing an
efficient mechanism for monetary policy transmission.
The fourth ma!or milestone was the facilitation of +2>1*( >5-(7 9/,7- transfer payments system. This
notable innovation in Kenyas payments system environment has provided greater access and increased
convenience to many low income households and micro&enterprises in Kenya including those in rural
areas who do not have access to conventional banking. The phenomenal growth in the transaction volumes
and values since the rollout of the first mobile money transfer system in )==< underlines the popularity and
usage of mobile money transfer platforms as indicated in the chart below. In view of their depth and
outreach mobile payment platforms have become an integral part of the national payments system as their
scope in terms of number of transactions is wider than that of the large value payment systems
>
.
Aifthly in (ctober )==; the 5entral Bank of Kenya in con!unction with the Kenya Bankers 7ssociation and
in liaison with the "inistry of Ainance implemented the value capping policy
;
. The policy stopped the
processing of high value payments using che'ues and *lectronic Aunds Transfers of Kenya +hillings one
#3% million and above through the Gairobi 7utomated 5learing -ouse. +uch high value transactions are now
processed through K*0++.
8
+ome of the players in mobile money transfers arena include; M-Pesa, Airtel Money, yuCash, Orange Money, and angaza,
among others
9
The value capping policy also affected other currency transactions such as the dollar euro and sterling pound.
33
+i$thly an important ongoing initiative is the C:(?/( T./,05)12, P.2@(0)
1A
3 which seeks to reduce che'ue
handling costs provide superior customer service levels improve risk management reduce li'uidity risk
and improve efficiency of our payment systems by streamlining the processing of che'ues. Gotably this will
remove the need to physically send bank representatives to the 5learing -ouse while at the same time
settlement certificates will be distributed electronically and all che'ues deposited will be stored at the point
of deposit.
7t a regional level the 5entral Bank of Kenya is working in collaboration with the other *ast 7frican 5entral
Banks to implement the *ast 7frica 0ayments +ystem #*70+% which is intended to facilitate real time
settlement of financial transactions among commercial banks in *ast 7frica using the five *ast 7frican
currencies. *70+ which is an integration of the BTC+ systems in *ast 7frica is e$pected to be operational
in the course of the year. The payment systems moderni2ation achievements include:
i%. 0romotion of greater efficiency and effectiveness of the payment clearing and settlement
systems;
ii%. 0rovision of an enabling environment for the development of various instruments and
mechanisms for an integrated modern and technologically sound payment system for transfer of
funds between transacting parties;
iii%. Aacilitation of irrevocability of payment and finality of settlement arrangements;
iv%. Beduction in the length of payment cycles for high value payments to +ame&4ay settlement.
... EB1-)1,8 5,7 =.2=2-(7 *5C- 5,7 .(8/*5)12,-
The 5entral Bank #/5BK1% under its mandate under +ection 9 #7% 3#d% of the 5entral Bank of Kenya 7ct
has drafted the Gational 0ayments +ystem Bill whose ob!ective is to enhance the Banks oversight role
over 0ayment +ystems in Kenya. @ith regards to *0+ the 5BK recently launched the draft Begulations for
the 0rovision of *lectronic Betail Transfers and *lectronic "oney. The regulations are aimed at giving
certainty in the operation and regulation of the retail payment industry.
10
This will become operational by 3
st
Eune )=33.
3)
7dditionally for *0+ systems the national I5T policy vide its Kenya Ca2ette Gotice )==H recogni2es the
current body of laws relating to banking and financial institutions are inade'uate in dealing with the privacy
and security concerns identified in the issues pertaining to electronic commerce. It also recognises the
need for a comprehensive policy legal and regulatory framework in order to:
#a% support I5T development investment and application;
#b% promote competition in the industry where appropriate;
#c% address issues of privacy e&security I5T legislation cyber crimes ethical and moral
conduct; and
#d% copyrights intellectual property rights and piracy.
The Kenya 5ommunications #7mendment% Bill )==> which was to amend the Kenya 5ommunications 7ct
3;;> and address some of the challenges cited by the Gational I5T policy as indicated above came into
operation in Eanuary )==;. (ne of the key sections is 0art KII on electronic transactions #e&transactions%.
Though it outlines what involves electronic transactions it insufficiently caters for the privacy and security
concerns for such type of transactions.
36
39