What happened

The Central Bank of Kenya (CBK) has formally announced a set of new expectations aimed at strengthening artificial intelligence (AI) risk management across the country’s banking sector. In the announcement, CBK outlined that banks must now adopt more rigorous governance frameworks, conduct regular risk assessments, and ensure transparency in AI‑driven decision‑making processes. The guidance was issued together with commentary from Vellum Kenya, a local consultancy that has been monitoring AI adoption in financial services. While the circular does not prescribe exact technical standards, it signals a clear regulatory shift toward proactive oversight of AI models that influence credit scoring, fraud detection, and customer service interactions.

Context and background

AI technologies have been increasingly integrated into Kenyan banks over the past few years, driven by the need for faster credit decisions, improved fraud detection, and enhanced customer experience. Major banks such as KCB, Equity, and Co‑op have deployed machine‑learning models for loan underwriting, while fintech partnerships have introduced chat‑bots and predictive analytics. The rapid uptake has raised concerns among regulators about model bias, data privacy, and systemic risk, especially as AI decisions become more opaque to both customers and supervisory bodies.

CBK’s new expectations build on earlier supervisory notices that highlighted the importance of data governance and cyber‑security in the financial sector. The central bank has previously issued guidelines on cloud computing and digital payments, but this is its first comprehensive effort to address AI‑specific risks. The move aligns with global trends, where central banks in the UK, Singapore, and the US are publishing AI oversight frameworks to safeguard financial stability.

Vellum Kenya, cited in the CBK release, has been advising banks on the practical implementation of AI controls. According to Vellum, many Kenyan institutions are still in the early stages of formalizing AI governance, often relying on ad‑hoc committees rather than dedicated risk units. The consultancy’s input helped shape CBK’s emphasis on documented risk‑assessment cycles, model validation, and clear accountability lines within banks.

Compared with what is normal

Historically, Kenyan banks have focused regulatory compliance on traditional risks such as credit, liquidity, and operational resilience. AI‑related oversight was limited to general technology risk clauses embedded in broader IT policies. The new CBK expectations represent a departure from that norm by carving out AI as a distinct risk category that requires dedicated monitoring and reporting.

  • Earlier guidance treated AI as part of overall IT risk, with no separate reporting requirement.
  • Under the new expectations, banks must produce quarterly AI risk dashboards for CBK review.
  • Model validation, previously optional, is now mandated to follow documented statistical testing procedures.
Why it matters

For Kenyan SMEs and everyday consumers, the CBK’s AI risk framework matters because it seeks to protect them from unfair or erroneous algorithmic decisions. A biased credit‑scoring model could deny loans to viable businesses, while an opaque fraud‑detection system might flag legitimate transactions, causing inconvenience and reputational harm. By demanding transparency and regular validation, CBK aims to ensure that AI tools operate fairly and reliably, preserving trust in the banking system. Moreover, clearer regulatory expectations reduce the likelihood of sudden compliance shocks, giving banks time to upgrade their models and avoid costly penalties.

Practical steps
  • Form an AI risk committee that includes senior risk, compliance, and data‑science personnel to oversee model governance.
  • Conduct a baseline AI inventory to identify all models used in credit, fraud, and customer‑service functions, documenting data sources and decision logic.
  • Implement a quarterly model‑validation schedule that includes back‑testing against actual outcomes and bias‑impact assessments.
  • Engage external experts, such as Vellum Kenya or similar firms, to review AI governance frameworks and provide independent assurance.

The Financial Management & Analysis team at Beavoren Ventures can help banks and SMEs navigate these new AI risk expectations, offering tailored assessments, model‑validation support, and compliance reporting solutions.

Need help with compliance? Email info@beavorenventures.co.ke or call +254 716 296 857.

Disclaimer: This article is informational and does not constitute formal tax, audit or legal advice. For guidance specific to your circumstances, please contact Beavoren Ventures.