Kenya’s recycled SIM rules target privacy risks for banks and mobile money users

A mobile phone number can remain attached to a bank account, a payment service or an online profile long after its original owner stops using it.

Kenya’s Communications Authority (CA) is proposing a central database that would help service providers establish whether a mobile number has changed ownership before sending messages to it. The plan targets a gap between telecommunications operators, which manage number reassignment, and banks, fintech companies and messaging providers that may continue using outdated customer contact records.

The proposed database would allow third-party value-added service providers to check whether a mobile number has been recycled before sending messages to it. Telecommunications operators would submit lists of deactivated and recycled numbers to the regulator every three months to support the verification process.

The CA said in its response to public comments that querying the database would help ensure messages reach the rightful owner of a number. The mechanism is intended to address cases where businesses continue using contact details that were valid when a customer registered but have since changed hands.

The risks extend beyond ordinary promotional messages. A bank could send transaction alerts to a number now held by another person, while a service that relies on one-time passwords or SMS-based account recovery could expose an authentication message to someone who has no connection to the original account holder.

A central database could help providers identify reassigned numbers before sending these messages, but it would not automatically remove old numbers from customer profiles or unlink them from financial and online accounts. Businesses would still need reliable account-update procedures, secure recovery processes and accurate customer records.

The proposal resembles the United States Federal Communications Commission’s Reassigned Numbers Database, which helps eligible callers check whether a telephone number has been reassigned since a specified date. Kenya’s system would need clear rules on access, data accuracy and how providers should act when a number is flagged as recycled.

The proposed rules would also require operators to give advance notice. Thirty days before the relevant period expires, they would publish lists of numbers due for deactivation through their websites, national newspapers and other media channels.

The CA’s proposals also address people in custody who may be unable to maintain activity on their mobile lines. The Commissioner-General of Prisons would facilitate exemptions for eligible inmates, including remand prisoners whose circumstances could prevent them from using their SIM cards for extended periods.

The proposal has implications for banks, savings and credit cooperative organisations, mobile money providers, fintech firms and companies that send bulk messages on behalf of businesses. These organisations often depend on mobile numbers for transaction notifications, customer engagement and account verification.

A central verification mechanism offers a way to identify reassigned numbers without requiring the previous owner to disclose personal details to contacts or service providers. However, its practical value will depend on whether providers check the database before sending sensitive communications and what they are required to do when a match indicates that ownership has changed.

Businesses may also face technical and operational costs as they adapt their systems to the proposed requirements. Telecommunications operators would need to maintain accurate reassignment records, while banks and other service providers may need to integrate verification checks into messaging, authentication and customer-management systems.

The rules will need to clarify how often providers should check the database, which types of messages require verification and how organisations should handle numbers identified as recycled. These details will be particularly important for one-time passwords, account recovery requests and financial alerts, where sending a message to the wrong person can have consequences beyond unwanted communication.

The safeguards do not remove the need for customers to update their contact details with banks, mobile money providers and other services when they stop using a number. A number may remain linked to an account even after a telecommunications operator has reassigned it, so account holders should follow each provider’s procedures for changing registered contact details.

For service providers, the database would offer a shared way to identify changes in number ownership, but it would need accurate and timely information to be effective. Quarterly reporting, for example, may leave a gap if a number is reassigned before the latest records are available, making the final update and verification requirements important.

Kenya’s proposed database addresses one part of that problem by connecting number reassignment records with the organisations that use mobile numbers to communicate with customers. Whether it provides meaningful protection will depend on implementation, data quality and the safeguards businesses maintain around their own accounts and messaging systems.

Real ESG impact doesn’t happen in panels alone, it happens in the rooms where financiers, operators, and policymakers actually align. Our GreenShift Forum 2026 cuts the noise, bringing together the people rewiring Africa’s sustainability and energy frameworks for one focused day in Nairobi. Secure your seat.

Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.