Rwandan fintech company KAYKO Group Ltd has secured an international payment security certification, strengthening its readiness to introduce bank card payment services for small and medium-sized businesses through its integrated digital platform, according to its founders.

The company achieved the Payment Card Industry Data Security Standard (PCI DSS) version 4.0.1 certification following an assessment by Digital Jewels Africa Limited, a Qualified Security Assessor. The certification was validated on November 10 after an assessment of KAYKO’s payment services environment, including its corporate office and data centre.

PCI DSS is a globally recognised standard that sets security requirements for organisations involved in processing, transmitting or storing payment card information, helping protect it against theft and unauthorised access.

The achievement comes as KAYKO prepares to introduce card payment acceptance services, allowing merchants to receive payments through the same platform they use to manage their businesses.

ALSO READ: Kayko: A digital ledger simplifying business and growth for SMEs

Crepin Gontran Kayisire, Chief Executive Officer and Co-founder of KAYKO Group, said the certification lays the groundwork for expanding payment options while keeping security central to the company&039;s services.

"A customer standing at the counter is an opportunity a small business has worked hard to earn. How that customer chooses to pay should never stand in the way of a sale,” he said.

"This certification brings us closer to putting secure card acceptance into the hands of everyday entrepreneurs and giving their businesses more room to grow,” he added.

Compliance requires security measures covering access to sensitive information, network protection, vulnerability management, system monitoring and information security policies.

These safeguards are important as businesses increasingly adopt digital payment systems that involve handling customers' financial information. For merchants and their customers, they help reduce exposure to data theft, unauthorised access and payment-related fraud.

Kayisire said KAYKO wants to make card payments easier for small businesses by integrating the service into devices they already use.

"We are working to make cumbersome payment devices a thing of the past by bringing card acceptance directly to the device merchants already carry everywhere: their phone,” he noted.

The planned service will integrate card transactions with KAYKO's existing business management tools, bringing sales, settlement information, reconciliation and financial reporting into one account.

For example, a retailer using the platform to monitor inventory, record sales and track expenses would also be able to manage card transactions within the same system. This could reduce manual reconciliation work and give businesses a clearer picture of their finances.

However, the card acceptance service is yet to be launched. KAYKO says it is completing the necessary partnerships, integrations and operational preparations before introducing it.

Building trust in digital payments

Adedoyin Odunfa, Group Chief Executive Officer of Digital Jewels Africa, which assessed KAYKO and guided it through the certification process, said the standard helps protect cardholder information during storage, transmission and processing.

She said the certification reflects a commitment to safeguarding not only the company's systems but also merchants and customers using its services.

"By doing this, they are securing themselves and, very importantly, their clients, their merchants and anybody who transacts with them can be assured of a very high level of vigilance and security,” she said.

Digital Jewels Africa, an information technology governance, risk, compliance and capacity-building firm established in 2008, operates in about 20 African countries, including Rwanda.

Odunfa said organisations need systematic security measures to manage the growing risks associated with digital technologies, including artificial intelligence.

"IT adds value, gives benefit, but you will not be able to realise that benefit because you will have breaches, you will be opened up to attacks, you'll be exposed. So now, more than ever before, organisations need to adopt a systematic, methodical way to manage their risks,” she said.

She explained that PCI DSS focuses primarily on technical payment security, while frameworks such as ISO 27001 provide a broader approach to managing information security.

Odunfa also cautioned that certification should not be treated as a one-off achievement, urging KAYKO to maintain its security investments through continuous improvements, staff training and stronger oversight of business partners.

"You can’t afford to rest on your laurels when you’re certified. Indeed, you become a target for the mysterious hackers. They want to test and see if you're really more secure,” she said.

Expanding opportunities for SMEs

Founded in 2021, KAYKO has attracted more than 15,000 businesses across East Africa to its platform, which helps SMEs manage sales, inventory, expenses and financial reporting, according to Kayisire.

The company aims to help small business owners manage their finances more effectively and improve their ability to access capital.

The latest certification strengthens the security foundation for this ambition as KAYKO prepares to introduce additional payment options for merchants seeking to serve customers who increasingly prefer cashless transactions.

Kayisire said the company would continue investing in security controls, staff awareness and ongoing compliance as it develops its payment services.

The next step will be translating the certification into an operational card acceptance service while maintaining the security standards needed to build merchants' and customers' confidence.

KAYKO, which is licensed by the National Bank of Rwanda, has been developing its financial services infrastructure to bring business management and digital payments into a unified platform. The PCI DSS certification represents another step toward making these services available to small businesses.