Bank Of Uganda Tightens Security Controls After Reported Breaches

KAMPALA, Uganda: The Bank of Uganda has tightened its internal security controls following a series of incidents that raised concerns about the protection of sensitive systems and information at the country’s central bank.

Governor Michael Atingi-Ego told Parliament that the bank had reviewed its controls and addressed weaknesses after incidents that included the reported loss of laptops and allegations that its systems had been hacked.

Atingi-Ego disclosed on Monday, 7 September, while appearing before Parliament’s Public Accounts Committee on Commissions, Statutory Authorities and State Enterprises (COSASE), which was examining the central bank’s financial statements and audit matters for the financial year ended 30 June 2025.

Bank of Uganda rejects hacking claim

The Governor disputed the description of one of the incidents as a hacking attack, saying the matter instead involved fraudulent payments.

“First of all, can I correct you? There was no hacking in Bank of Uganda. There were fraudulent payments,” Atingi-Ego told the committee.

He said the central bank had assessed the weaknesses identified during the incidents and strengthened its controls.

“We have looked at them and where there are any perceived weaknesses, we have strengthened them. And we are confident in that,” he said.

The distinction between a cyberattack and fraudulent payments is significant because it points to a potentially different set of vulnerabilities, including payment controls, internal processes or the compromise of credentials, rather than necessarily a direct breach of the bank’s computer systems.

Governor refuses to disclose new security measures

Atingi-Ego declined to provide Parliament with details of the additional controls introduced at the bank, arguing that publicly disclosing the measures could expose the institution to further security risks.

“Chair, we cannot share our controls because the bad boys are out there,” he said.

ALSO READ: Warning Signs for Africa’s Economies as Top Currencies Come Under Pressure

He indicated that the information could instead be provided to the committee in camera.

The disclosure comes amid growing scrutiny of cybersecurity and financial controls at institutions responsible for managing sensitive financial and economic information.

For a central bank, the protection of payment systems, financial data and institutional infrastructure is particularly important because weaknesses can have consequences extending beyond the institution itself.

COSASE questions Bank of Uganda on public confidence

The issue was raised by COSASE chairperson Muwada Nkunyingi, who pressed the Governor on what had been done to safeguard the central bank and restore public confidence following reports of security breaches at its headquarters.

The parliamentary scrutiny places the reported incidents within a wider examination of the central bank’s governance and financial management.

Atingi-Ego told the committee that the Auditor-General had issued an unmodified, or clean, audit opinion on the Bank of Uganda’s financial statements.

According to the Governor, the audit found that the financial statements presented a true and fair view of the bank’s financial position, performance and cash flows.

Two key audit matters were identified: expected credit losses on financial assets, and litigation and contractual claims. Neither resulted in a qualification of the bank’s audit opinion.

MPs raise concerns over treatment of bank customers

The parliamentary hearing also moved beyond the central bank’s own internal controls, with MPs questioning how commercial banks and other financial institutions treat borrowers and customers.

Concerns raised included loan terms, excessive recovery charges, alleged manipulation of customer accounts and limited access to mechanisms for resolving complaints.

Nkunyingi criticised the reliance on customer complaint boxes, describing it as a “lacklustre response” and calling for a system that allows members of the public to lodge complaints directly and have them resolved.

MPs demand stronger regulation of commercial banks

Ndorwa County West MP Eliab Naturinda challenged the Bank of Uganda to take a stronger regulatory position against commercial banks accused of mistreating customers.

He also called for greater regulation of lending through mobile money platforms.

The committee questioned whether borrowers are adequately protected from unfavourable loan conditions and aggressive debt-recovery practices.

Nkunyingi cited complaints in which customers allegedly incurred substantial recovery costs and bailiff fees while their original loans remained outstanding.

“You will find a customer who borrowed Shs5 million being charged Shs20 million for recovery and it went to a bailiff, but the loan is still existing,” he said.

He challenged the central bank to demonstrate practical measures to protect customers and investigate such practices.

Bank of Uganda points to consumer protection rules

Responding to the concerns, Hannington Wasswa, representing the bank’s Executive Director for Supervision, said the Bank of Uganda had issued consumer protection guidelines requiring financial institutions to provide borrowers with a key facts document.

The document is intended to give borrowers information including the applicable interest rate, repayment frequency, collateral requirements and repayment schedule.

The disclosure requirements are designed to ensure that customers understand the terms of credit before taking on financial obligations.

The COSASE hearing has therefore put two separate but connected issues under the spotlight: the Bank of Uganda’s responsibility to secure its own systems and assets, and its wider regulatory responsibility to protect the public from abusive or unfair financial practices.

While the Governor maintains that weaknesses identified following the reported security incidents have been addressed, the decision to withhold details of the new controls means Parliament will have to rely on closed-door scrutiny to assess the adequacy of the measures.

The hearing also underscores the broader challenge facing Uganda’s financial sector as regulators seek to balance institutional security, financial stability and stronger consumer protection.