Strengthening cybersecurity in Rwanda’s SACCOs amid digital transformation

Rwanda is rapidly advancing its vision of inclusive economic growth and financial empowerment by embracing digital transformation across its financial institutions. This shift, driven by innovative technologies, aims to broaden financial access to underserved communities, enhance operational efficiency, and contribute to the nation's sustainable development goals. ALSO READ: $40m digital ID project 'back on track' - official tells lawmakers A vital part of Rwanda’s financial landscape, Savings and Credit Cooperatives (SACCOs), have played a crucial role in grassroots financial inclusion and local economic empowerment. The recent automation of systems across all 416 Umurenge SACCOs marks a significant milestone, accelerating the adoption of digital channels such as mobile banking, digital wallets, Front Office Services like deposits, withdrawals, loans, and automated transaction platforms. ALSO READ: Balancing speed and security: Safeguarding Rwanda’s digital transformation While digital transformation brings numerous benefits, including improved service delivery, expanded outreach, and greater efficiency, it also introduces increasing cybersecurity risks. These risks encompass potential financial losses, data breaches, fraud, account takeover, system vulnerabilities, operational disruptions like ransomware attacks, regulatory penalties, reputational damage, and emerging threats driven by artificial intelligence such as deepfakes, synthetic identities, and advanced social engineering. If these risks are not effectively managed, they could undermine the core principles of confidentiality, integrity, and availability of data, which are essential to maintaining trust and ensuring the sustainability of Rwanda’s financial sector. Why SACCOs are prime cybercriminal targets SACCOs present attractive targets for cybercriminals for several reasons. Their reliance on various third-party platforms—including core banking vendors, mobile money services, payment gateways, managed service providers, and system integrators creates multiple points of vulnerability along the supply chain that attackers may exploit. Moreover, SACCOs operate on a trust-based membership model that depends heavily on member confidence and community loyalty. Any breach that damages this trust threatens not only member confidence but also the very survival of these institutions. Additionally, SACCOs hold valuable data such as member savings, loan records, and transaction histories, making them appealing targets for financial fraud and identity theft. The stakes are high both financially and regulatorily, as cyberattacks can result in heavy penalties, direct losses, and damage to reputation. These risks are exacerbated by the common perception that SACCOs have weaker cybersecurity infrastructures compared to larger financial institutions, often characterized by limited budgets, small IT teams, outdated systems, lack of continuous monitoring, and slower patch management. This perceived vulnerability makes SACCOs more enticing and easier targets for cyberattacks. Growing cyber threat landscape in Africa and Rwanda’s SACCOs Across Africa, the rapid growth of digital financial services has greatly improved financial inclusion and economic development. However, this progress comes alongside a surge in cybercrime. INTERPOL’s Africa Cyberthreat Assessment Report 2025 forecasts that cybercrime losses in Africa will exceed three billion US dollars between 2019 and 2025, with the financial sector being among the most affected, followed by healthcare, energy, and government sectors. In regions including Western and Eastern Africa and Rwanda specifically cyber-dependent and cyber-enabled crimes now account for over 30% of all reported criminal activity, presenting serious challenges to SACCOs that are essential to grassroots financial inclusion. The threats posed extend beyond immediate financial losses to jeopardize national economic stability and public confidence. Recent national data underscores these concerns. The 2024 National Money Laundering and Terrorist Financing Risk Assessment revealed that in the past five years, 90 cybercrime cases were detected, representing 13% of total crime proceeds. Out of these, 66 cases were prosecuted, culminating in 39 convictions involving 62 suspects. The growth of internet access and digital financial services has facilitated cybercriminals’ use of hacking, phishing, and malware to illicitly access financial systems, manipulate funds, or steal assets. These realities highlight both the increasing threat landscape and significant gaps in Rwanda’s capacity to detect, prevent, and respond effectively to cybercrime within its digital financial sector. Reflecting the growing urgency of cybersecurity, PwC’s Digital Trust Insights Survey for East Africa reports that 74% of businesses in the region now prioritize cybersecurity, signalling a shift in perception that recognizes cybersecurity as a fundamental business imperative rather than just an IT issue. For SACCOs in Rwanda, building robust cyber resilience is essential not only to safeguard member assets but also to maintain stakeholder trust, organizational continuity, and support sustainable growth in the evolving digital economy. Strategic imperatives for SACCO cybersecurity To address these challenges, Rwanda’s SACCOs must adopt comprehensive, multi-layered cybersecurity strategies aligned with both national directives and international best practices. This effort begins with strict adherence to national frameworks and regulations, including guidance from the National Bank of Rwanda, the National Cybersecurity Authority, the Data Protection Law, the National AI Policy, and the Financial Sector Development Strategy. Effective governance and leadership are paramount; SACCOs need to develop thorough cybersecurity and data privacy policies, integrate privacy by design principles, and maintain dedicated teams tasked with ongoing risk assessment, vulnerability remediation, and cyber insurance aligned with their risk appetite. Implementing zero trust security models where continuous authentication and authorization are required for all users, devices, and applications regardless of their network location is critical to preventing unauthorized access. Additionally, fostering a culture of cybersecurity awareness through continuous training and simulated phishing exercises can reduce human error. SACCOs are encouraged to adopt recognized frameworks such as the NIST Cybersecurity Framework (CSF), ISO/IEC 27001, ISO/IEC 42001, or the Center for Internet Security (CIS) Controls to manage information security effectively. Investments in advanced technologies like endpoint protection, firewalls, intrusion detection and prevention systems, network segmentation, encryption, and multi-factor authentication can significantly reduce risk exposure. Continuous risk management practices including real-time monitoring, vulnerability assessments, penetration testing, and strict user access controls based on the principle of least privilege are essential. Preparing for incidents through tested response and disaster recovery plans, supported by secure and encrypted backups, ensures operational resilience when breaches occur. Prioritizing data privacy to safeguard the confidentiality and integrity of member information is crucial. Moreover, stringent oversight of third-party partners helps mitigate supply chain risks. Collaboration with regulators and industry bodies such as the Rwanda Information Society Authority (RISA), The CyberHub, and the National Bank of Rwanda for threat intelligence sharing, capacity building, and coordinated defense efforts strengthens overall cybersecurity posture. By embedding these strategic imperatives into their operations, SACCOs in Rwanda can better protect member assets, comply with regulatory requirements, and foster sustainable financial inclusion powered by secure digital innovation. Rwanda’s SACCOs occupy a central place in the national financial inclusion agenda, leveraging digital innovation to extend vital services. Yet, the full potential of this transformation hinges on making cybersecurity a fundamental business priority. Safeguarding member data, complying with regulations, and ensuring operational resilience demand a collective commitment from leadership down to frontline staff. Only through comprehensive cybersecurity measures can SACCOs preserve the trust and financial stability of their communities. Integrating cybersecurity deeply into their organizational fabric will reinforce Rwanda’s vision of a resilient, inclusive, and prosperous digital financial ecosystem. In today’s digital age, cybersecurity is not a luxury for SACCOs it is an indispensable necessity. Alex Mihigo Butera is a Senior Associate, IT Consulting and Risk Services, at PwC Rwanda, while Anthony Njeeh is and Associate Director, Government and Public Sector, at PwC Rwanda.

Opinions

Strengthening cybersecurity in Rwanda’s SACCOs amid digital transformation