Bank of Uganda tightens controls after security breach

KAMPALA — The Bank of Uganda (BoU) has tightened its internal controls following security breaches that included the reported loss of laptops and fraudulent payments, Governor Michael Atingi-Ego has told Parliament.

Dr Atingi-Ego said the central bank had reviewed its systems and strengthened areas where weaknesses were identified, although he declined to disclose the specific measures for security reasons.

The Governor was responding to questions from Parliament’s Committee on Commissions, Statutory Authorities and State Enterprises (Cosase) on Monday about reported security breaches at the central bank.

“We have looked at them and where there are any perceived weaknesses, we have strengthened them. And we are confident in that,” Dr Atingi-Ego said.

He, however, rejected the description of one of the incidents as a hacking attack, saying it involved fraudulent payments.

“First of all, can I correct you? There was no hacking in Bank of Uganda. There were fraudulent payments,” he said.

The Governor told the committee that details of the strengthened controls could not be disclosed publicly because doing so could expose the bank to further security risks.

“Chair, we cannot share our controls because the bad boys are out there. They will know what our controls are,” he said, adding that the information could be shared with the committee in camera.

The matter was raised by Cosase chairperson Muwada Nkunyingi, who sought an explanation on the measures taken to secure the central bank and restore public confidence following reports of security breaches at its headquarters.

The MPs were scrutinising BoU’s financial statements and audit matters for the financial year ended June 30, 2025.

Clean audit

Dr Atingi-Ego told the committee that the Auditor-General had issued an unmodified, or clean, audit opinion on the bank’s financial statements.

He said the audit opinion indicated that the financial statements gave a true and fair view of BoU’s financial position, financial performance and cash flows.

The two key audit matters identified by the Auditor-General — expected credit losses on financial assets, and litigation and contractual claims — did not result in a qualification of the audit opinion, he added.

The committee also questioned the central bank over complaints about loan terms, recovery charges, alleged manipulation of customers’ accounts and limited access to complaint-resolution mechanisms.

Mr Nkunyingi described reliance on customer complaint boxes as “a lacklustre response” and challenged BoU to establish a more accessible system through which members of the public can lodge complaints and have them resolved.

Ndorwa County West MP Eliab Naturinda also urged the central bank to take a stronger regulatory stance against commercial banks accused of mistreating customers.

He further challenged BoU to strengthen oversight of digital and mobile money lending, amid concerns about loan terms and debt recovery practices.

Loan recovery

The committee raised concerns about the protection of borrowers from unfavourable loan terms and aggressive debt recovery practices.

Mr Nkunyingi cited complaints alleging that some financial institutions deduct recovery costs and bailiff fees from customers’ accounts while the underlying loans remain outstanding.

“You will find a customer who borrowed Shs5 million being charged Shs20 million for recovery and it went to a bailiff, but the loan is still existing,” he said.

He challenged BoU to demonstrate “practical and tangible efforts” to protect borrowers and investigate such practices.

Responding, Hannington Wasswa, who represented the Executive Director for Supervision, said the central bank had issued consumer protection guidelines requiring financial institutions to provide borrowers with a key facts document.

The document, he said, should clearly state the interest rate, repayment frequency, collateral requirements and repayment schedule.

The engagement comes as MPs continue to scrutinise BoU’s financial management, regulatory oversight and measures to protect customers of financial institutions.