Kenyan banks are in a standoff with Kenya Revenue Authority (KRA) over its mandate to integrate banking systems with its tax infrastructure — a move that raises alarm over data privacy.

While KRA argues that direct access to financial data is essential to combat rampant tax evasion, banks say the proposal threatens customer privacy, undermines trust, and jeopardises the security of sensitive information.

KRA’s plan to monitor real-time financial transactions aims to streamline tax collection, improve compliance, and close gaps in revenue generation.

With tax evasion costing the government billions annually, KRA insists that better access to banking data will help identify discrepancies and create a more equitable tax system. 

The tax authority claims that global examples show such systems can function without infringing on privacy, but critics remain unconvinced.

Kenya Bankers Association (KBA) has pushed back vehemently, arguing that the integration violates Kenya’s Data Protection Act of 2019, which prohibits the sharing of personal financial data without explicit consent.

The Act was designed to protect citizens’ privacy in an increasingly digital world — yet the KRA’s request to access banking data in real time would directly contradict this safeguard.

Banks contend that no system, however sophisticated, is immune to breaches, and that KRA’s proposal opens the door to massive data security risks.Beyond the legal challenges, the impact on consumer behaviour could be significant.

With mobile money platforms like M-Pesa playing a vital role in Kenya’s financial inclusion, the prospect of government surveillance has triggered fears that citizens may retreat to informal financial systems to safeguard their privacy.  If the public believes their financial transactions are being monitored, they could lose trust in formal banking and mobile money systems, reversing the strides made in expanding access to digital finance.

For banks, this isn’t just about data protection; it’s about maintaining the integrity of the financial system. The proposed integration could have serious long-term implications for consumer confidence, particularly as cyberattacks become more sophisticated.

Despite heavy investments in cybersecurity, banks worry that linking their systems directly to KRA’s could expose them to attacks that compromise their customers’ most sensitive data.

This isn’t a hypothetical threat — the growing number of global breaches in financial institutions shows how vulnerable such data can be.

KRA insists that its intention is to enhance tax collection, arguing that any concerns over data misuse are overstated. The tax authority maintains that the data will only be used to improve tax transparency and prevent evasion. The taxman’s request to bypass certain privacy laws, however, risks creating a dangerous precedent — one that could set a global trend for governments seeking to undermine data protection measures in the name of efficiency. But even KRA’s assurances have not allayed fears. The question remains: How can the government ensure that this access is used strictly for tax-related purposes and not for broader surveillance or other government interests?

Without a clear, enforceable framework that guarantees accountability, the proposal feels more like an overreach than an effort to improve tax compliance.

The solution, many experts argue, lies in compromise. One option could be to limit KRA’s access to aggregated or anonymised data that would allow the authority to spot trends without breaching individual privacy.  Another is to establish a clear legal framework that regulates the sharing of data, offering customers robust protections while allowing KRA to fulfill its mandate. This is not just a regulatory battle; it’s about the future of Kenya’s digital economy.

KRA moves forward without resolving the privacy concerns, it risks alienating millions of Kenyans who rely on mobile money platforms, digital banking, and financial institutions for their daily transactions.  The consequences could be dire — not only for the banking sector but for the entire national economy, as reduced consumer confidence would impede growth.

Kenya finds itself at a crossroads. The government’s push for more tax transparency through banking integration is understandable, but it must not come at the cost of fundamental rights to privacy.

If Kenya is to become a leader in digital financial services, it must get this balance right.  The outcome of this debate will set the tone for how governments in the region handle the delicate intersection of data privacy and digital tax compliance in the future.

The Writer is a Machine Learning Researcher and Technology Policy Analyst.