In an increasingly complex financial landscape, asset tracing has become a critical tool in combating fraud, money laundering, corruption, embezzlement, and other financial crimes. Globally, it plays a vital role in protecting economic integrity and advancing financial justice.

The Objective of Asset Tracing

The primary goal of asset tracing is to uncover assets deliberately concealed through complex financial structures such as offshore accounts, shell companies, layered transactions, or third-party holdings. Individuals engaged in financial misconduct often attempt to obscure the origin and beneficial ownership of illicit funds to evade detection.

Asset tracing seeks to dismantle these structures and reveal the true flow of funds.

Key Stages in Asset Tracing

Asset tracing typically involves three core stages:

1. Identification

Investigators determine what assets exist and who ultimately controls them. This may include bank accounts, real estate, company shares, intellectual property, luxury assets, and other holdings.

2. Tracking

This stage focuses on following the movement of assets across financial accounts, jurisdictions, corporate entities, and digital platforms to establish patterns and connections.

3. Recovery

Where appropriate, legal measures are initiated to freeze, seize, or facilitate the return of assets to their rightful owners through civil or criminal proceedings.

Expertise and Tools

Asset tracing is a multidisciplinary effort involving forensic accountants, legal professionals, financial investigators, and, in some cases, law enforcement agencies.

Modern investigations increasingly rely on advanced technologies such as data analytics, artificial intelligence, digital forensics, and access to international financial intelligence databases to detect unusual transactions and ownership patterns.

Civil and Criminal Applications

In civil matters, asset tracing supports the recovery of misappropriated funds and the enforcement of judgments or compensation claims.

In criminal proceedings, it provides evidentiary support for prosecution by establishing financial trails and demonstrating illicit enrichment or unlawful transfers.

Challenges in Asset Tracing

Despite its effectiveness, asset tracing presents notable challenges, including:

• Banking secrecy laws in certain jurisdictions
• Limited transparency in corporate ownership structures
• Cross-border legal complexities
• The growing use of digital currencies and anonymized financial platforms

However, stronger regulatory frameworks, international cooperation, and technological advancements are steadily improving investigative outcomes.

Conclusion

Asset tracing is a powerful mechanism for uncovering hidden wealth, restoring accountability, and reinforcing financial integrity. As financial crimes continue to evolve in sophistication, the role of asset tracing remains indispensable in promoting transparency, justice, and ethical financial conduct worldwide.

The post Asset Tracing appeared first on Riskhouse International Limited.

At RISKHOUSE INTERNATIONAL LIMITED, we specialize in uncovering the truth through discreet, professional investigations that empower our clients to make informed and confident decisions.

1. Fraud Investigations

Fraud does more than cause financial loss, it damages credibility, stakeholder confidence, and long-term growth.

Our investigative team applies advanced methodologies to detect, analyse, and document fraudulent activity, including:

• Forensic Accounting – Identifying irregularities, misstatements, and financial manipulation.
• Digital Forensics – Uncovering hidden communications, data breaches, and system misuse.
• Evidence Collection & Documentation – Developing defensible reports to support litigation, regulatory action, or internal disciplinary processes.

We deliver clarity where suspicion exists.

2. Due Diligence

Every investment, acquisition, partnership, or major transaction carries inherent risk. Effective due diligence is not optional, it is essential.

Our due diligence services provide comprehensive insights into:

• Financial standing and operational stability
• Regulatory compliance status
• Litigation history and reputational exposure
• Undisclosed liabilities or conflicts of interest

We help clients enter transactions with full visibility and reduced uncertainty.

3. Background Checks

Trust is important, verification is critical.

Our background screening services help organizations and individuals confirm credibility before making hiring, partnership, or investment decisions. We:

• Verify employment history, academic credentials, and professional certifications
• Authenticate documents and qualifications
• Review criminal and civil records where applicable
• Identify potential reputational or integrity concerns

Sound decisions begin with verified information.

4. Asset Tracing

Hidden or undisclosed assets can complicate fraud investigations, debt recovery, shareholder disputes, and matrimonial matters.

Our asset tracing services establish:

• The physical existence and location of property or individuals
• Ownership structures and beneficial interests
• Asset movement patterns and economic status analysis
• Links between entities and individuals through ownership trail reviews

We uncover what others attempt to conceal.

Conclusion

Fraud, hidden liabilities, and undisclosed assets pose serious threats to business continuity and personal financial security.

At RISKHOUSE INTERNATIONAL, we combine forensic expertise, rigorous investigation, and timely reporting to provide accurate, actionable intelligence. Our work equips clients with the clarity they need to mitigate risk, protect their interests, and make informed strategic decisions.

The post Riskhouse International: Protecting Your Interests appeared first on Riskhouse International Limited.

For years, online romance scams have operated under familiar names, from the infamous “Nigerian prince” emails to organized cyber fraud rings often referred to as Yahoo Boys or Sakawa networks. Their tactics once relied on crude sob stories, stolen photographs, and urgent requests for bank transfers.

Today, those schemes have evolved and cryptocurrency has given them a sophisticated and far more devastating edge.

Welcome to the era of “pig butchering”, a calculated blend of romance and investment fraud that turns emotional connection into financial ruin.

According to blockchain analytics firm TRM Labs, pig butchering scams declined in 2024 due to improved awareness and stronger enforcement efforts. Yet an estimated $2 billion was still stolen that year alone. Between 2020 and early 2024, global losses are estimated at $75 billion, a figure experts believe is significantly understated, as many victims never report their losses due to embarrassment, shame, or fear of stigma.

This Valentine’s Day, many well-meaning romantics may not realize that some “perfect matches” aren’t soulmates at all, but scammers in disguise, patiently grooming their targets before making their move. As you search for a spark, remember: the most charming “soulmate” in your inbox could be a digital predator, waiting for the perfect moment to drain your savings.

How Pig Butchering Works

The term “pig butchering” comes from the Chinese phrase sha zhu pan, describing a long-con scam that unfolds over weeks or months. The scheme reportedly originated around 2019 and has since spread globally, costing victims millions, and in some cases, their entire life savings.

The metaphor reflects the method. Victims are deliberately “fattened up” with affection, attention, daily conversations, and emotional intimacy before being financially exploited. The “pig” is the victim; the “butchering” is the systematic draining of their assets.

The scam often begins innocently:

• A “wrong number” text.
• A dating app match.
• A friendly message on social media or even a professional networking platform.

Scammers use highly polished fake profiles, increasingly enhanced with AI-generated photos that appear convincingly real. They share stories about their careers, ambitions, and dreams of building a future together. Love bombing is common. Emotional dependency follows.

Once trust is firmly established, cryptocurrency is introduced as a “shared investment opportunity” framed as a way to secure the couple’s financial future.

Initially, victims may be directed to legitimate crypto exchanges to build credibility. Later, they are steered toward fraudulent trading platforms or private wallets controlled entirely by the scammer.

These fake platforms display impressive gains. Small withdrawals may even be processed successfully to reinforce legitimacy. But when victims attempt to withdraw substantial “profits,” obstacles suddenly appear: unexpected “taxes,” “verification fees,” or “liquidity issues.” Soon after, the platform disappears, and with it the romantic partner.

Because cryptocurrency transactions are pseudonymous, irreversible, and borderless, recovery is extremely difficult. In some cases, victims are persuaded to share private keys or transfer funds into wallets they do not control, permanently sealing their losses.

How to Know You’re Being Targeted

Pig butchering thrives on emotional momentum. Watch for these red flags:

• Unsolicited messages framed as accidental or unusually friendly outreach.
• Pressure to move conversations quickly from public platforms to private messaging apps.
• Persistent avoidance of video calls or in-person meetings, often with elaborate excuses.
• Claims of exclusive or insider crypto investment opportunities “just for you.”
• Investment websites with URLs that closely resemble, but do not exactly match, well-known exchanges.
• Security warnings flagging apps or platforms as untrusted or potentially harmful.

If you notice even one of these signs, pause. Verify. Slow down the emotional pace.

Real opportunities, and real relationships, do not require secrecy or urgency.

Practical Prevention Measures

• Never send money or invest with someone you have only met online.
• Avoid sharing details about your income, savings, or investments with strangers.
• Never disclose sensitive information such as bank PINs, mobile money credentials, ID numbers, passport details, private keys, or seed phrases.
• Be skeptical of extraordinary profit claims. If it sounds too good to be true, it almost certainly is.
• Educate colleagues, clients, and family members about social engineering tactics.
• Implement crypto fraud monitoring frameworks and seek expert guidance where necessary.

Love Should Build, Not Drain

The success of pig butchering scams is not based on technical ignorance. It is built on emotional manipulation, patience, and the powerful promise of a shared future. After all, who wouldn’t want both love and financial security?

But real love builds. It does not pressure. It does not rush. It does not come with investment links and guaranteed returns.

Pig butchering is not merely a cryptocurrency issue. It is a trust, governance, and risk management challenge. As digital assets become increasingly embedded in everyday financial life across Africa and beyond, so too does the risk.

The myth that only the inexperienced fall victim is false. Professionals, executives, seasoned investors, and first-time users alike have lost tens of thousands of dollars, sometimes their life savings.

Unlike cinematic heartbreaks, the damage caused by these scams is real, lasting, and devastating. It drains more than bank accounts; it erodes confidence, trust, and belief in connection.

This Valentine’s Day, protect your heart, and your wallet.

Happy Valentine’s Day from all of us at Riskhouse International!

We wish you relationships built on trust, investments grounded in diligence, and connections that enrich your life, not exploit it. May your love be genuine, your partnerships transparent, and your financial decisions made with clarity and caution.

Stay informed. Stay vigilant. And celebrate wisely. 🥂

The post Cupid’s dark side: How to spot “pig butchering” crypto scams this Valentine’s Day appeared first on Riskhouse International Limited.

WHY CLOUD FORENSICS MATTERS

• In Digital Forensic Investigation, it helps to;
• Identify the Source of Incidents: We determine how, when, and where a breach occurred by analyzing logs, file activity, and metadata within cloud environments.
• Preserve Digital Evidence: Our team follows strict chain-of-custody procedures, maintaining integrity for legal or regulatory use.
• Reconstruct Attack Timelines: Advanced forensic tools allow us to map events across systems, accounts, and virtual environments.
• Ensure Legal & Compliance Readiness: Our reports meet evidentiary and audit standards to support investigations or litigation.
• Minimize Business Disruption: We conduct investigations with minimal impact on your active systems and operations.
• In Cloud Security & Incident Response, it helps to;
• Detect Misconfigurations & Insider Threats: We uncover access loopholes and suspicious user activity that compromise cloud integrity.
• Accelerate Breach Response: Our structured approach helps you contain incidents quickly and restore systems securely.
• Strengthen Future Defenses: Insights from investigations guide improvements to policies, controls, and staff awareness.

WHY CHOOSE RISKHOUSE INTERNATIONAL?

Our certified experts combine deep knowledge of cloud infrastructure, cybersecurity, and legal compliance to deliver accurate and actionable findings. Whether you use AWS, Azure, Google Cloud, or hybrid environments, we tailor our forensic process to your systems while ensuring visibility, accountability, and resilience. We don’t just find the evidence; we help you prevent the next attack.

Take Action Now

When data is compromised, every second counts. Contact RISKHOUSE INTERNATIONAL today to strengthen your cloud security posture or investigate a potential breach. You may reach us through our:-

• LinkedIn: https://ke.linkedin.com/company/risk-house-international
• Phone: 0726748889

The post Uncover the truth, secure the cloud appeared first on Riskhouse International Limited.

Why network forensics matters

• For Digital Forensic Investigation, it helps to;
• Identify breach origins: We trace attacks through network logs, traffic analysis, and device forensics to determine where and how compromise occurred.
• Preserve critical evidence: Our investigators maintain full chain-of-custody to ensure integrity for legal or regulatory use.
• Reconstruct attack timelines: Using advanced forensic tools, we recreate the sequence of intrusion events for complete visibility.
• Support compliance and legal action: Our detailed reports meet evidentiary and audit requirements, strengthening your position during investigations.
• Maintain operations: We conduct forensic work with minimal disruption to your ongoing business.
• For Network Security & Incident Response, it helps to;
• Expose hidden threats: Detect unauthorized access, data exfiltration, and malware communication across your network.
• Assess security gaps: Evaluate firewalls, intrusion detection systems, and configurations to identify vulnerabilities.
• Contain and recover faster: Our experts isolate affected systems, eliminate threats, and guide secure restoration.
• Build long-term resilience: Findings from investigations help improve network monitoring, controls, and staff awareness.

Why choose riskhouse international

Our certified specialists combine deep knowledge of network infrastructure, cybersecurity, and digital forensics to provide accurate, actionable results. Whether your systems are on-premise, cloud-connected, or hybrid, we tailor our approach to deliver transparency, accountability, and strengthened defense. We don’t just respond to incidents; we help you prevent the next one.

Take Control!

When a network breach occurs, time is critical. Contact Riskhouse International today to investigate suspicious activity or assess your network’s resilience. You may reach us through our:-

• LinkedIn: https://ke.linkedin.com/company/risk-house-international
• Phone: 0726748889

The post Trace every threat, strengthen your network appeared first on Riskhouse International Limited.

Sector Specific Compliance Obligations

1. Betting, SACCOs, Retirement Schemes, Mining, Real Estate, Accounting, Legal & Compliance Secretarial Services, key obligations include:
2. Implement Customer Due Diligence (CDD) and customer identity verification.
3. Reporting suspicious transaction to the Financial Reporting Centre (FRC).
4. Proper recording keeping of transactions.
5. Staff training on AML/CFT risks and developing internal compliance controls.

• Public Benefit Organizations (PBOs):

Regulation, supervision and enforcement of compliance for AML purposes including:

• Implementing internal controls to prevent abuse of terrorism financing, including due diligence on donors and beneficiaries, record-keeping, and reporting suspicious activities.
• Developing focused, proportionate and risk-based actions to address Terrorism Financing Risks posed by such public benefit organizations.
• Periodically conducting an assessment of the terrorism financing risks posed to such public benefit organizations.

• Dealers in Precious Metals and Dealers in precious stone, key obligations include:
• Registering as an officially reporting entity.
• Implementing Customer Due Diligence (CDD) and customer identity verification.
• Monitoring high value transactions including when engaging in any cash transaction with a customer equal to or above fifteen thousand US Dollars ($15000).
• Avoiding informal trading practices that could raise red flags.

• Members of Professional Bodies (ICPAK, ICPSK, Estate Agents Board, LSK), key obligations include:
• Integrating AML/CFT practices into daily operations.
• Complying with professional body supervision requirements.
• Preventing misuse of professional services for illicit activities.

If your business falls in any of the above, you need to ask:

1. Have you assessed the money-laundering and terrorism-financing risks covering you customer base, services & products, geographic exposure, and transaction types and limits?
2. Are your identification, verification and screening procedures including beneficial ownership up to date? (including Enhanced Due Diligence (EDD))
3. Are your records properly maintained (transactions, client identities) and internal reviews for the required period?
4. Do you have documented AML/CFT policies, periodic training, framework, internal audits and a designated compliance officer?
5. Do you have procedures in place to flag and report suspicious transactions to the Financial Reporting Centre (FRC) or other competent authority?
6. Do you provide training to your staff and enforce internal controls (segregation of duties, approval thresholds, monitoring)?
7. Is senior management aware and accountable? Are there oversight procedures including sanctions, non-compliance, and escalation processes?
8. Are you prepared for regulatory inspection, peer review or audits of your compliance framework?

Even businesses with internal compliance teams or Artificial Intelligence (AI) compliance systems often discover gaps only during regulator inspections, the right independent review from a consultant will not only save your business from financial and reputational risks but boost regulatory confidence.

In addition, the Act outlines heavy fines and imprisonment as part of penalties for Non-Compliance:

General Provisions (All Sectors and Reporting Institutions):

• Financial fines:
• Of between Kes. 5M to Kes. 20M for legal persons and between Kes. 1M to Kes.10M for natural persons.
• Additional penalties not exceeding one hundred thousand shillings in each case for each day or part thereof during which such violation or non-compliance continues.
• Imprisonment: financing of terrorism attracts a term not exceeding 20 years for a natural person or a fine not exceeding Kes. 20 M for a legal person.

The March 2026 deadline is only four months away, being proactive reduces exposure to fines, imprisonment, and reputational risk while strengthening both investor and regulatory confidence.  At Riskhouse International Limited, our free 30 minutes AML/CFT Health Check & Independent Assessment gives you clarity on your obligations and breaks what needs to be done into practical, sector-specific obligations, whether you are a PBO, Betting or Precious Dealer.  

At RISKHOUSE INTERNATIONAL, our multi-disciplinary team combines legal, risk, and compliance to provide an objective review of policies and controls, specialized guidance in ESG, Crypto, and AI governance, AML/CFT policies, access to benchmarking and best practices from multiple industries, and efficient implementation support. This allows your internal teams to focus on execution while ensuring that your governance framework is comprehensive, practical, and strategically aligned, turning policies into organizational growth.

The post The Anti-Money Laundering and Combating of Terrorism Financing Laws (Amendment) Act 2025: Is your Business Ready for March 2026? appeared first on Riskhouse International Limited.

The above statistics clearly show that, AI systems are increasingly influencing lending outcomes, offering substantial opportunities to improve financial inclusion and reduce operational costs. At the same time, they introduce complex risks that require responsible fairness, inclusivity and strong risk and governance frameworks.

AI in Credit Risk Assessment and Scoring: How it Works

A credit-scoring AI system, as described by the OECD Framework for the Classification of AI Systems (February 2022);

“Credit-scoring system is representative of a machine-based system that influences its environment (whether people are granted a loan). It makes recommendations (a credit score) for a given set of objectives (that, together, determine credit-worthiness). It does so by using both machine-based inputs (historical data on people’s profiles and on whether they repaid loans) and human-based inputs (a set of rules). With these

two sets of inputs, the system perceives real environments (whether people have repaid loans in the past or whether they are repaying loans on an ongoing basis). It transforms such perceptions into models automatically. A credit-scoring algorithm could use a statistical model, for example. Finally, it uses model inferencing (the credit-scoring algorithm) to formulate a recommendation (a credit score) of options for outcomes (providing or denying a loan)”

Reference: OECD (2022), OECD Framework for the Classification of AI systems, OECD Publishing, https://oecd.ai/en/ai-publications/framework-classification

With the Potential Practical Applications being:

1. Loan Approval Decisions: The AI system analyzes multiple local data sources, including mobile money transactions histories, utility payments and behavioral indicators to generate more accurate credit scores, even for customers with limited credit history.

1. Repayment Trend Analysis: Machine learning can detect subtle patterns in customer behavior that signal reliability or early signs of financial distress, enabling institutions to proactively manage risk management and adjust repayment plans.

1. Default Risk Reduction: By analyzing more variables than traditional scoring methods, AI enhances risk categorization and helping institutions to reduce Non-Performing Loans (NPLs) and improve portfolio performance.

Demonstrated Success of AI Credit Scoring in Africa

According to the OECD Africa Capital Markets Report 2025, AI-based credit scoring as evidenced from some African countries has contributed to financial inclusion and capital market participation. For instance, in Ethiopia, over 380,000 MSMEs accessed approximately USD150M in capital through uncollateralized credit facilities driven by AI-credit scoring. Similarly, in Zambia, the Fintech sector uses AI-powered algorithms to offer uncollateralized credit to underbanked customers, and analyzing data sources to assess credit-worthiness. While in Kenya, some institutions leverage AI to provide credit to DFS consumers and for debt management solutions.

Reference: OECD (2025), Africa Capital Markets Report 2025, OECD Capital Market Series, OECD Publishing, Paris. https://doi.org/10.1787/7d26e1d3-en

Some Potential Risks for Using AI in Credit Scoring include but not limited to:

While use of AI in credit scoring has demonstrated success in promoting financial inclusion and capital across Africa, its adoption introduces risks that may directly impact business strategy:

1. Bias and Discrimination: It has been argued that many financial institutions focus on “willingness” to repay rather than “true repayment capacity”. Customers with irregular or seasonal income which is common in Kenya’s informal sector, or the underserved population including Persons with Disabilities, may be unfairly scored. Algorithmic design and data assumptions can unintentionally lead to bias.
2. Limited Transparency and Explainability: Complex models often act as “black boxes”. Institutions may struggle to explain loan denials or risk classification, affecting customer trust.
3. Data Drift: AI models may underperform when customer’s behavior or economic conditions change. A model trained in stable economy can misclassify risk pricing, and affect portfolio performance during inflationary spikes or income variability.
4. Data Protection and Security Risks: AI systems rely on sensitive financial and personal data. Weak governance increase exposure to breaches.

Are Financial Institutions Ready for Responsible AI in Lending?

Given the risks of bias, data drift, and data privacy and security, AI doesn’t just automate decisions, it directly impacts a person’s financial position by influencing access, cost, and terms of credit, with potentially long-term consequences if decisions are inaccurate or unfair.

All the more reason financial institutions should begin designing and implementing AI governance frameworks, including policies and risk management, across the entire AI Lifecyle, ensuring responsible adoption and oversight from day one.

The following questions help executives assess readiness and ensure AI is used responsible:

1. Understanding Your System
2. Do we fully understand how our AI models make decisions, including statistical or inference processes?
3. Do we monitor for data drift and maintain data quality monitoring, retraining models as necessary to ensure accuracy?
4. Are we mitigating interpretation bias by using explainable AI techniques (e.g., SHAP, LIME) and training teams on bias, fairness, and interpretability?
5. Data Governance & Compliance
6. Are we applying the principle of data minimization, collecting only the personal data necessary for AI to function effectively?
7. Have we validated the relevance and representativeness of training data, and are we using anonymization, pseudonymization, or sampling where possible?
8. Do we have robust data security measures, continuously monitoring and auditing AI systems and the data they rely on?
9. Fairness and Customer Treatment
10. Are we testing for bias or unfair outcomes across customer groups, including vulnerable groups such as Persons with Disabilities?
11. Do we have mechanisms to address customer complaints or feedback related to AI-driven decisions?
12. Human Oversight and Governance
13. Are accountability roles and decision-making responsibilities clearly defined?
14. Are we using AI strategically to create competitive advantage and support board-level decision making?
15. Regulatory Preparedness
16. Are we ready for the upcoming CBK Guidance note on AI and other regulatory expectations?
17. Do we have proactive strategies to align AI practices with emerging regulations and governance standards?

In conclusion

The CBK 2025 survey on Artificial Intelligence in the Banking Sector shows that 50% of the institutions have adopted AI, yet only 30% have formal data strategies and only 41% have AI policies. This highlights the risk and governance gap at a time when regulatory expectations are increasing.

And even as CBK finalizes its Guidance Note on AI, institutions have an opportunity to strengthen AI governance and position themselves for innovation and competitive advantage. Engaging advisory experts early in the AI lifecycle (development, deployment or procurement), ensures institutions stay ahead while deploying AI responsibly. At Riskhouse, we provide AI risk advisory and help institutions establish AI governance and risk management that aligns with their business objectives.

At RISKHOUSE INTERNATIONAL, our multi-disciplinary team combines legal, risk, and compliance to provide an objective review of policies and controls, specialized guidance in ESG, Crypto, and AI governance, access to benchmarking and best practices from multiple industries, and efficient implementation support. This allows your internal teams to focus on execution while ensuring that your governance framework is comprehensive, practical, and strategically aligned, turning policies into organizational growth.

The post Artificial intelligence (AI) in credit risk assessment and scoring for financial institutions in Kenya appeared first on Riskhouse International Limited.

Mobile/digital credit providers in Kenya have been flagged for various data protection and harassment practices:

• In 2022 the Office of the Data Protection Commissioner (ODPC) reported that by 30^th September it had received 1,030 complaints; of those, 555 were admitted, with 299 relating to digital lenders.
• Some lenders were found to be accessing borrowers’ phone contacts, sending messages to those contacts, sharing data with third-parties, or posting personal data of defaulters.
• One lender, White path Company Limited (owner of several apps) was fined Kes. 5 million after about 150 complaints for mining contacts and sending unsolicited messages.
• Another provider, Mulla Pride Ltd (apps: Ke Credit, Fair Cash) was fined Kes 2.9 million for using names/contacts obtained from third parties to shame borrowers.
• There have been reports of apps requesting access to messages, location, calendar, contacts and then using that data for credit scoring or post-default pressure.

While digital credit can promote access, many apps operate with little transparency, and misuse of personal data is widespread.

Mechanisms of Data Collection & Abuse

What data is collected?

Many of these loan apps request wide permissions when installed:

• Access to contacts and call logs.
• Access to messages, mobile money transaction history, location, calendar.
• Some share data with third-party analytics / marketing firms or credit bureaus without clear consent.

How misuse happens

• Debt-shaming tactics: Borrower defaults, app uses contact list to message friends/family of borrower, or threatening calls to contacts.
• Unauthorized sharing of borrower data with third party debt collectors or marketing firms.
• Lack of informed consent: Borrowers may not understand the extent of data being collected or how it’s used.
• Unlicensed or rogue apps: Some apps operate without being properly regulated/licensed, thus operate with fewer safeguards.

Regulatory & Legal Responses

Key laws & rules

• The Data Protection Act, 2019 (Kenya) lays out rights of data subjects, obligations of data controllers/processors including breach-notification duties.
• The Central Bank of Kenya (CBK)’s Digital Credit Providers Regulations 2021: Lenders must be licensed as Data Controllers and Processors, they must avoid unauthorised calls to contacts, must not harass borrowers, must obtain consent for third-party data sharing.
• The ODPC has powers under Section 63 of the Data Protection Act to impose penalties for non-compliance.
• Platform rules: Google (Play Store) updated policy in 2023, banning personal-loan apps from accessing photos/contacts unless essential.

What borrowers Should Do

• Check licensing: Before borrowing from a mobile-loan app, verify whether it is a licensed DCP (digital credit provider) under CBK regulations.
• Review permissions: When installing the loan app, look at what permissions you are granting (contacts, SMS, location) and whether those are reasonable for a loan-app.
• Read the privacy policy: Though often lengthy, see whether the app clearly states how your data will be used, with whom data will be shared, and what rights you have.
• Limit access: If an app is requesting access to data not clearly required (e.g., contacts, photos), you may consider declining or using a different provider.
• Protect your contacts: Be mindful of which apps have access to your address book; avoid granting unnecessary permissions when possible.
• Report abuses: If you receive harassing messages/calls from a lender or your contacts are being targeted, lodge a complaint with the ODPC.
• Budget carefully: Borrow only what you can repay, understand the interest and penalty structure, and avoid rolling over short-term apps into deeper debt.

Conclusion

The rise of mobile-loan apps in Kenya has created both opportunities and risks. On one hand, they provide quick access to credit. On the other, they have been implicated in serious breaches of data protection, harassment of borrowers and misuse of contacts and device data. The regulatory framework is evolving, with enforcement actions increasingly visible, but gaps remain. Borrowers must remain vigilant, understand their rights, and take care in choosing loan apps and controlling the data they share. At RISKHOUSE INTERNATIONAL, we have a team of professionals with the expertise to offer continuous data protection training, data protection impact assessment (DPIA), data protection compliance among others. We would be happy to serve you! Contact us at info@riskhouse.co.ke .

The post Digital Credit and Data Protection in Kenya appeared first on Riskhouse International Limited.

Even if policies aren’t a current priority, gaps, outdated or incomplete policies can expose your organization to financial, operational, and reputational risks. Often, these gaps only become visible when a regulator, investor, or when an operational incident such as a data breach occurs, creating unanticipated leadership risks.

Essential Policies Every Organization Needs

Every organization needs a foundation of policies that protect its operations, employees, and stakeholders. At a minimum, these include:

1. Governance & Ethics – Code of Conduct, Conflict of Interest, Anti-Bribery, Whistleblower Policy and Anti-Money Laundering (AML), Countering the Financing of Terrorism (CFT), and Countering Proliferation Financing (CPF) Policy.
2. People & Culture – Recruitment, Diversity & Inclusion, Performance Management, and Employee wellbeing.
3. Finance & Operations – Procurement, Expense Management, Fraud Management Policy, Enterprise-Wide Risk Management Policy and Business Continuity Plan (BCP).
4. Technology & Data – Privacy Policy, Data Protection, Cybersecurity, IT Use and Social Media.

Policies for Emerging Risks

As business environments evolve, organizations also need policies such as:

1. ESG (Environmental, Social, and Governance) policy – Covering sustainability, diversity, human rights, and transparency to strengthen corporate reputation and investor confidence.
2. Virtual Assets Management policy – integrated with AML/CFT/CPF controls, help ensure regulatory crypto compliance while providing customer protection.
3. Artificial Intelligence (AI) Governance Policy – covering guidelines for responsible use, transparency, and accountability, mitigating potential ethical, privacy, and reputational risks.

Does Your Organization Have These Policies? Do They Work?

Policies only protect your organization if they are current, consistent, and actually followed. Key questions to consider:

1. Policy Audit and Gap Analysis: When was your last comprehensive review?
2. Stakeholder Engagement: Were the right stakeholders engaged to ensure policies reflect operational reality?
3. Policy Drafting and Development: Are your policies tailored and aligned with industry best practices and regulatory requirements?
4. Implementation and Training: Do employees and your business partners know what’s expected and act on it?
5. Continuous Review and Improvement: Are your policies evolving with organizational needs, regulatory changes and technological advancements?

If any of these key policy questions give you a pause, it may indicate gaps that could create financial, operational, or reputational exposure. Even highly capable in-house teams may benefit from external, independent perspective.

At RISKHOUSE INTERNATIONAL, our multi-disciplinary team combines legal, risk, and compliance to provide an objective review of policies and controls, specialized guidance in ESG, Crypto, and AI governance, access to benchmarking and best practices from multiple industries, and efficient implementation support. This allows your internal teams to focus on execution while ensuring that your governance framework is comprehensive, practical, and strategically aligned, turning policies into organizational growth.

The post Policy review and development: From policy gaps to strategic growth appeared first on Riskhouse International Limited.

However, while CBK & CMA aims to protect consumers by licensing and overseeing service providers, it cannot fully eliminate the wave of scams flourishing on social media platforms like Telegram, WhatsApp, TikTok, Twitter/X, and Instagram.

The Psychology Behind Crypto Scams

Scammers and Influencers prey on human psychology, exploiting greed and the fear of missing out (FOMO), to lure victims with false promises of quick, guaranteed returns. In addition, buzzwords such as “CBK licensed” or “CMA regulated” will be frequently misused to create a false confidence and to persuade people to invest, often without verifying the legitimacy.

Key Social Media Cryptocurrency Scams to Watch Out for:

1. Cryptocurrency-based Ponzi Scheme: Aggressively advertised on WhatsApp or Telegram groups promising high, risk-free returns.
2. Cryptocurrency-based Job scams: Scammers posing as legitimate company employees lure victims through social media posts or text messages offering fake part-time jobs and assigning fake click-based tasks through scam websites.
3. Pump and dump schemes: Scammers use social media to artificially hype up a low-value cryptocurrency, spreading false claims to drive up its price and later sell causing the price to crash.
4. Impersonation Scams: Fraudulent profiles mimicking exchanges, regulators like CBK or CMA, or industry influencers to gain trust and steal funds.
5. Fraudulent Celebrity Endorsements: Deepfake videos/ audio using AI, fake testimonials, or paid influencers on Instagram, TikTok, or Facebook promoting fake ICOs and Coins.
6. Phishing links: post pushing a link via DMs to “claim tokens”, verify an account” or “fake transactional approval prompts”, once link is clicked the scammer steals the cryptocurrency.
7. Pig butchering scams (also known as Romance scams): a long-term investment scam, often involving cryptocurrency, where scammers “fatten up” the victim (“the pig”) with trust and affection before “butchering” them, i.e. stealing a large amount of money.

According to Chainalysis (Blockchain Analytical firm), approximately $9.9billion was lost to crypto scams globally in the year 2024. In addition, recent reports from Kenya and Nigeria, an estimated amount of $840million was lost by investors, through Crypto Bridge Exchange(CBEX), which advertised itself as a “crypto-powered trading platform backed by artificial intelligence, promising tantalizing returns of up to 100% in just 30 days”,  and required only a simple sign-up through a website or app, often shared via WhatsApp or Telegram by trusted friends” (Source:  Chainalysis.com , Kenyanwallstreet.com)

While the VASP Act strengthens oversight of Virtual Asset Service Providers, it does not extend to the informal and fast-moving world of social media where scams thrive. Regulations is critical foundation, but effective protection requires a layered approach, combining consumer education, and expert advice.

At RISKHOUSE INTERNATIONAL, we help our clients navigate Kenya’s evolving crypto landscape with confidence. Our tailored services include risk assessments, scam awareness training, Blockchain forensics, and regulatory crypto compliance. We boast of a team of expert investigators who integrate fraud and risk management, regulatory compliance, blockchain forensics, and legal advisory to build frameworks that reflect both the regulator’s expectations and market realities. Partner with RISKHOUSE INTERNATIONAL, to assess your readiness, identify exposure, and build crypto compliance systems that work in practice to stay competitive in Kenya’s Crypto regulatory landscape.

The post The risk of social media cryptocurrency scams in Kenya despite VASP regulation appeared first on Riskhouse International Limited.