A report by the House Committee and two court cases challenging the bank’s subsidiary, Finserve’s entry into the market dominated by Safaricom, is spelling doom for the new entrant.
Equity bank CEO James Mwangi (left) and Safaricom’s Bob Collymore
Safaricom, with about 19 million subscribers was the first to cry foul on the Thin Sim technology that Equity Bank wants to use to roll out its mobile money transfer platform.
The Sim cards are film-thin, embedded with a chip that can be layered over the active side of another operator’s Sim to act as a bridge between the phone and the primary card. Then, a lawyer moved to court arguing his account’s information was at risk since the system had not been given a clean bill of health.
Further, a lobby, Kituo cha Sheria sued the bank over the thin Sim. The parties in their separate suits were concerned about the trial in which they argued risked losing huge monies if the overlay SIM cards were withdrawn within the trial period over security lapses.
But Equity Bank CEO James Mwangi, while appearing before Parliamentary Committee on Energy and Communication, said the Ultra-Thin Sim to be embedded on the main card will never be live or work at the same time at any time with the primary Sim card.
He explained that the Sim poses no risk of interrupting Personal Identification Numbers (PINs), SMSs or distorting subscribers’ information as alleged. The issue of security was addressed by Communications Authority of Kenya, which approved the use of Taisys’ Thin SIMs as they complied with all minimum mandatory international standards, adding that there is no existing evidence to warrant blocking them. “Following the outcome of (an) investigation, the Communications Authority of Kenya (CA) board has decided that there is no sufficient evidence to block the entry of the thin SIM in the Kenyan market,” CA chairman Ben Kituku said. Safaricom had faulted the claims by both the CA and Equity Bank, saying the technology will have a negative impact on mobile phone subscribers if Thin Sims are overlaid on users’ primary cards.
Safaricom Head of Regulatory Services Stephen Chege told the Committee that it had tested the technology in which it left gaps on the security of data contained in the primary card, adding that there was a possibility that it will interfere withSafaricom’s M-Pesa services. “From testing, we found out that it is a bridge between what you type in your phone and the main Sim. The Thin Sim is capable of seeing through any transaction,” he said.
High Court Judge George Odunga ordered Finserve Africa Ltd to stop distributing the cards – meaning Equity’s entry into the market could further stall until the case is heard and determined. Justice Odunga issued the orders after Kituo Cha Sheria moved to the court, complaining that Thin Sim technology has security risks to the users and that they were put into the market without proper review of their security to the data and PIN on primary sim draped by the thin one.
The orders were issued to the detriment of the bank which is viewed to give Safaricom a run for its profits in the mobile money market. In the first case waged by lawyer Bernard Murage, who is said to be an account holder with the bank, he say that he fears that he could lose his personal data once the cards were rolled out and in use. In a certificate of urgency before High Court Judge Mumbi Ngugi, Murage had argued that, “The basis of the matter is founded on the fact that Finserve Africa and Equity Bank do intend to roll-out thin Sim card technology on a one year trial basis, without providing any safeguard to protect the vulnerability of over eight million account holders and their personal data.”
Kituo cha Sheria in its petition said the risk is high given that data on the primary Sims, and pins of millions of mobile telephone customers including banks, utility companies and security agencies would be compromised in an irreparable manner.
“The Bank has promised to compensate its customers in case of fraud but this does not match the risk the Sims pose to them,” the lobby group says in its court.
Ascertain its security
In the case by Mr Murage, he argued that the guidelines provided by the Cabinet to mitigate any possible losses were not adhered to when CA allowed Equity Bank to enter the lucrative mobile money services market using the thin Sim technology.
“It is apparent that the decision to permit the deployment of thin SIM technology then subsequently seeking consultancy services to ascertain its security reveals that the decision was taken in total failure to take into account all considerations,” court papers by Kituo Cha Sheria read.
The Parliamentary Committee on Information and Technology wants the process suspended until an independent technical evaluation and functional test is done and the Thin SIM card security audit sanctioned by the CA is accomplished.
The Committee in its report blamed both the Ministry of ICT and Central Bank of Kenya (CBK) in the manner in which Equity Bank was licensed to operate technology in Kenya. It described the process as “indecent haste” that did not take into account the concerns of the public.
The report also states that due process was not followed in licensing Equity Bank to operate the technology, thereby exposing Kenyans to risk as far as privacy is concerned. It noted that there was no evidence to guarantee security to the users.
“Though the ministry and the CA maintained that both Sim cards cannot be on at the same time, there were indications that the thin derives its power from the primary Sim and they did not provide technical evidence to that effect that by the thin deriving its power from the primary SIM, the Thin SIM can actually work while the primary SIM is off,” the report read in part.
The mobile money market currently serves more 25 million people in Kenya and in the Diaspora and these include financial institutions like banks, insurance companies, utility providers and security agencies with the monthly transactions valued at about Sh200 billion.
A nine month survey into the mobile market by the CBK shows that Sh1.7 trillion was transacted by mobile money firms, in which Equity Bank might not have a taste of, if its issues remain unresolved.