Revealed: Why Thugge and Mbadi Disagree on Bank Capital

The Central Bank of Kenya (CBK) is facing an unprecedented credibility test as sophisticated syndicates bleed the country’s financial sector of billions under the cover of a rapid digital rollout.

The regulator’s newly released Kenya Financial Sector Stability Report 2025 paints a grim picture of our financial institutions. According to the data, actual banking fraud losses jumped by nearly 20 percent to hit a staggering Ksh1.9 billion in 2025.

What should worry every ordinary depositor and industry stakeholder is where the heaviest blows are landing. Plastic money—card fraud—recorded the sharpest spike, exploding by 145 percent to drain Ksh645.19 million from the system. Ironically, this multi-million-shilling hemorrhaging occurred despite a drop in the number of reported incidents, pointing to highly precise, high-value strikes by cybercriminals.

While CBK Governor Kamau Thugge righty blames the “digitalisation of payments” for these ballooning vulnerabilities, pointing fingers is no longer a viable regulatory strategy. The banking sector cannot scale up digital innovations without matching them with aggressive, foolproof cybersecurity frameworks.

This multi-billion-shilling fraud crisis unfolds against the backdrop of an ugly, bureaucratic stalemate at the top of Kenya’s financial leadership. CBK and the National Treasury are actively locking horns over the implementation timelines for the Ksh10 billion minimum core capital requirement.

While Thugge wants a strict, progressive climb to weed out systemic vulnerabilities by 2029, Treasury Cabinet Secretary John Mbadi is pushing to push the goalposts to 2032 to cushion smaller lenders.

As an editorial voice, we must call out this dangerous flip-flopping. Smaller banks cannot build the necessary capital buffers if their existing revenues are consistently wiped out by digital syndicates.

The CBK must stop treating capital requirements and cybersecurity as separate conversations. If commercial banks want to push the boundaries of digital convenience, they must invest heavily in protective infrastructure.

The regulator’s primary mandate is to safeguard public trust. Right now, that trust is leaking to the tune of Ksh1.9 billion.

Faith-Grace feedback-opera-news-app@opera.com