Uganda’s financial intelligence unit wins global data security certification

KAMPALA, UGANDA – Uganda’s Financial Intelligence Authority (FIA) has received an international certification for protecting the sensitive financial data at the heart of the country’s fight against money laundering and terrorism financing. Officials described it as a first for such an agency in Africa.

Finance Minister Henry Musasizi handed the ISO/IEC 27001:2022 certificate to the authority on Thursday. He said the FIA had become the first financial intelligence unit on the continent to meet the standard, which independently assesses how organisations safeguard confidential information.

“I want to congratulate you upon being the first FIA to attain this in the whole of Africa,” Musasizi told officials at the ceremony. The ceremony also marked the launch of the authority’s client service charter.

The FIA is Uganda’s central agency for detecting illicit money. Banks and other reporting institutions are required to submit reports on suspicious transactions and on cash deposits of 20 million Ugandan shillings (about $5,400) and above. The authority analyses this information and shares intelligence with domestic law enforcement agencies and with financial intelligence units abroad.

Samuel Were Wandera, the FIA’s executive director, said the certification gave the institutions that supply that data an assurance that it was secure.

“We are trusted with very vital, private information from accountable persons, particularly in the financial sector,” Wandera told journalists. “This trust requires an organisation to have strong IT systems that hackers cannot access.”

He said the authority had chosen to submit its systems to external assessment. In his words, an organisation “may think” its systems are robust when they are not. The process took about a year.

The certification comes as Uganda works to consolidate gains made in the global campaign against illicit finance. In February 2024, the Financial Action Task Force (FATF), the Paris-based global standard setter, removed Uganda from its “grey list” of jurisdictions under increased monitoring. Countries on that list often face higher costs in international banking and investment.

Musasizi said the certification would strengthen confidence in the systems behind that achievement. He described digital infrastructure and cyber security as key enablers of Uganda’s economic growth plans.

“A secure cyberspace protects the integrity of our financial architecture,” he said. He urged the authority, having led in Africa, to begin competing for the top position globally.

The certification was funded under the Uganda Digital Acceleration Project. Officials put the value of the World Bank-backed programme, which is implemented by the National Information Technology Authority – Uganda (NITA-U), at $160m.

Johnson Tumusiime, NITA-U’s acting director of information security services, said the project was supporting 10 public bodies across sectors including energy, health and financial services to achieve the same certification.

The FIA, he said, was chosen because of its maturity and the competence of its team. Those qualities mattered because the World Bank programme runs on fixed timelines. The authority is the second of the 10 to be fully certified, after Uganda’s public procurement regulator.

Alinaffe Kalule, chairman of the FIA board, said the certification was “not a destination”. He said the authority would keep strengthening its systems against evolving threats, including those linked to artificial intelligence.

He said the new client service charter would set out clear service standards for the banks, regulators and security agencies the FIA works with. It is also intended to improve the secure sharing of intelligence with partners such as the Bank of Uganda, the Uganda Revenue Authority and the Inspectorate of Government.

Attention is now turning to Uganda’s next FATF-linked assessment, a mutual evaluation by the Eastern and Southern Africa Anti-Money Laundering Group scheduled for 2028.

Wandera said Uganda was updating its laws to reflect revised global standards. These include a draft bill to regulate virtual assets and cryptocurrency, aimed at preventing their use by criminals to move illicit funds.

“We are aligning our laws and institutions to demonstrate capacity to detect financial crimes ahead of the 2028 assessment,” he said.