Key proposed changes in the Draft CBK Risk Management Guideline 2026

Below is a summary of some of the key updates:

• Governance and accountability: The draft formally introduces the Three Lines of Defence model, with clearer responsibilities for the Board, business units, risk and compliance, and internal audit.
• Broader risk categories: Key risk categories expanded from 9 to 17. Added Cybersecurity, Data governance, Transfer pricing, ESG, Model, Third-party, Digital financial services/fintech, and ML/TF/PF risks. Compliance is reframed as Legal and Compliance risk categories.
• Risk appetite: Alignment of the risk appetite and tolerance with strategy and capital, and enhancement across all the risk categories.
• Liquidity management: Institutions will be required to have a documented liquidity management strategy. The draft also introduces a detailed Early Warning Indicators (EWI) framework with thresholds, escalation, monitoring frequency, and responsibilities. In addition, it requires liquidity monitoring at the individual legal-entity, foreign-branch, subsidiary, and group levels.
• Market Risk: The draft expands measurement beyond broad interest-rate, price and foreign-exchange risk to explicit treatment of repricing, yield-curve, basis and optionality risk, equity and commodity risk, credit-trading risk and market-liquidity risk.
  
  The draft also requires daily information on positions and accrued and unrealised profit or loss, independent data sourcing, intraday monitoring where risks fluctuate materially, independent valuation processes, pre-deployment validation and regular back-testing of market-risk models.
  
  The draft introduces criteria for allocation to the trading book, daily fair valuation, active management, transfer controls between banking and trading books, prudent valuation governance, marking-to-market, marking-to-model and independent price verification at least monthly.
• Operational resilience: Banks would be expected to identify critical operations and dependencies, establish tolerances for disruption and undertake scenario analysis against severe but plausible events. The Basel III Standardised Approach will replace the minimum Basic Indicator Approach for operational risk capital. The draft also requires establishing recovery plans for critical operational risk incidents and disclosing relevant operational risks and significant loss events to CBK.
• Technology risk: The minimum frequency for comprehensive internal and external ICT audits increases from once every two years to once every year.
• Country and transfer risk: Geopolitical and sanctions risk and climate and environmental risk have been included as additional risk types to be considered.  Prohibited and restricted country lists have also been added as considerations to factor into the systems/policies/procedures for guiding management of country risk.

The draft captures the following as part of the additional risk categories:

• Model risk: Introduces a comprehensive framework covering model governance, risk appetite, model lifecycle, independent validation and testing, ongoing monitoring, change management, third-party and AI models, model decommissioning and independent audit.
• Money laundering, terrorist financing and proliferation financing risk: Establishes a comprehensive, risk-based framework with requirements related to governance, customer due diligence, sanctions screening, proliferation financing, wire transfers, virtual assets and Virtual Asset Service Providers (VASPs), transaction monitoring, institutional risk assessments and group-wide controls.
• Third-party risk: The draft expands third-party risk management to include materiality assessment, concentration and systemic risk, due diligence, mandatory contract clauses, sub-outsourcing controls, ongoing monitoring, integrated disaster recovery, exit strategies, data return and deletion, independent assurance and stress testing.
• ESG and climate risk: The draft introduces a detailed ESG framework covering environmental, climate, nature, social and governance drivers; strategy and business-model assessment; Board oversight; policies; materiality; metrics; climate stress testing; limits; reporting; integration into credit, market, liquidity and operational risk; ICAAP and ILAAP; internal audit; and illustrative environmental, social and governance indicators.
• Digital financial services and fintech risk: The draft introduces a governance framework covering digital channels, APIs, cloud, AI, distributed ledgers, open banking, Backend-as-a-Service (BaaS), embedded finance, fintech partnerships, e-KYC, digital identity, automated decisions, digital fraud, customer protection, resilience and third-party accountability.
• Transfer pricing risk:  The draft requires identification of related-party and cross-border intra-group transactions, arm's-length methodologies, supporting documentation, monitoring of tax-law changes and transparent governance.
  
  For Kenya’s banking sector, the proposed changes may require more than policy updates. Banks may need to go beyond policy updates by reassessing risk governance structures and committee mandates, risk appetite and tolerance frameworks, risk taxonomies, processes, risk data analytics, aggregation and tools. Assess skill sets in specialised areas to meet evolving supervisory expectations.
  
  This summary covers the Draft CBK Risk Management Guideline 2026. It does not include updates made to the specific Draft CBK Prudential Guidelines and Draft Guidance Notes.  Read the full Draft CBK Risk Management and Compliance Guideline here.