There is no doubt that mobile money services have transformed and revolutionalised the financial sector in Uganda. Mobile money has created new opportunities especially for SMEs, supported the much needed financial inclusion especially in the informal sector that is largely unbanked. However, at the same time, the gaps in regulatory framework have led to the increased orchestration of cybercrimes like fraud, identity theft or impersonation and also allowed the telecoms to profit from unfair and obscure rates and charges for their services. Although the advent of mobile money services in Uganda was in 2009, until recently, there had been no direct regulation and licensing of the primary mobile money operators. There appears to have been a deliberate plan by government to use the test and learn approach before regulation notwithstanding public outcry for the same.
In 2012, Hon. Abdu Katuntu and a one Kimberly Kasana filed High Court Civil Suit No. 248 of 2012 in the Commercial Court against all telecoms, Bank of Uganda and Uganda Communications Commission[UCC]. In the said suit, the plaintiffs claimed that they had an interest in the proper operation and regulation of Telecoms’ mobile money services and were bringing the suit in public interest in the exercise of their duties as citizens under Article 17 of the Constitution of the Republic of Uganda. One of the orders sought was a Declaration that mobile money services were outside the scope of licenses issued by UCC. The Plaintiffs also sought an order directing Bank of Uganda and UCC to formulate policy and proper regulations for mobile money services. The said suit was dismissed at a preliminary level upon the objection of the Defendants that the plaintiffs did not have a right to bring the suit. Although the judge acknowledged that it was an offence for the telecoms to transact in the business of deposit taking or other financial institution business in Uganda without a valid license granted by Bank of Uganda, he noted that the Plaintiffs had no right to bring the action. Instead, he opined inter alia that it was DPP who is empowered and could commence criminal prosecution of anyone committing the offence of operating without a license.
In 2013, Bank of Uganda issued Guidelines for the operators of mobile money services that required them to establish a partnership with a licensed financial institution. As a result of the partnership, banks were required to liaise with the telecoms to ensure that there is management of financial services data, KYC requirements are met, consumer protection and liquidity management. Similarly, a National Working Group comprised of Bank of Uganda and UCC was formed to promote cooperation and joint oversight.
Although the Guidelines put in place some form of regulatory framework, they fell short in two fundamental ways. Firstly, since they were merely guidelines, they did not have the force of law that a statute or statutory instrument has. They merely offered guidance and indication as to what was required of the key players. As a result, there has been no significant reprimand of culprits in the several mobile money fraud cases reported by the media over the past years. Secondly, Bank of Uganda mainly protected the monetary value of mobile money transactions through appropriate regulation of the partnering financial institutions and not the telecoms per se. By and large, the telecoms largely remained accountable to UCC and not Bank of Uganda. Moreover, with UCC it was only in so far as its mandate as a Telecommunications regulator is concerned. Accordingly, with UCC, mobile money services were merely recognized as Value Added Services under the Telecommunications license.
After more than a decade, in September, 2020, the National Payment Systems Act took effect whilst the Regulations made thereunder were passed early this year. Pursuant to these laws, Bank of Uganda assumed full responsibility and mandate over the regulation of mobile money services in Uganda. It is in this regard, that in May 2021, Bank of Uganda issued 2 licences i.e Payment Service Provider Licence Class A and Electronic Money Systems Licence to MTN and Airtel’s newly created subsidiaries and affiliates MTN Mobile Money Ltd and Airtel Mobile Commerce (U) Ltd which are independent entities from the telecommunication companies.
In its statement to the press, Bank of Uganda noted that the new licensing regime will ensure effectiveness and integrity of payment systems. Bank of Uganda Governor, Emmanuel Tumusiime Mutebile noted that in carrying out their work, they will promote a vibrant and resilient payment eco system that promotes economic growth.
Although we are yet to see the effectiveness of Bank of Uganda as a regulator under the new licensing regime, the recent events in the industry inform us that the following issues must be given keen attention by the Regulator and the key stakeholders involved.
Data security and protection must be given a lot of attention. In this digital era, data is a big phenomenon and mobile money services involve the collection and generation of significant data of both personal and impersonal nature. Accordingly, there ought to be a robust framework that sufficiently protects the privacy and other data rights of consumers without stifling innovation and development of the digital economy.
In the recent past, there have been several security breaches that make an apparent case for a robust regulatory framework in relation to data protection and security. For example, in October last year, it was reported that US$3.2 million was lost after a security breach purportedly orchestrated using over 2000 sim cards across both MTN and Airtel networks which also affected some banks and disrupted mobile money services for days. There have also been several cases of fraudsters masquerading as representatives of the telecoms, and hacking into mobile money accounts of customers and defrauding them of their money after illegal and unauthorized access to data.
I recently received notice from Airtel indicating that my mobile money account and data is being transferred to the new licensee, Airtel Mobile Commerce (U) Ltd and that continued use of service shall be taken as my acceptance. This as of itself raises data security and data sharing concerns. Shouldn’t the customers be given an opportunity to make a better prior and informed consent by the telecoms as opposed to assuming that silence amounts to acceptance? Does the licensee which is a third party albeit a subsidiary have a right to merely assume ownership of data without privity of contract? Do telecoms have a right to assign and transfer data to third parties without the express consent of the customers? Ofcourse I am aware that all these efforts are aimed at complying with the new legal regime, however, data protection considerations must be given due regard. Relatedly, the fact that there is an interlink between the telecom and the mobile money operators and given the fact that the underlying account is tagged to the mobile number, poses a potential risk of unauthorized access to data. There is an even more onerous challenge in tracing the culprit and perpetrator in case of the leakage of data given the duplicity and sharing of data between telecoms and the mobile money operators. Bank of Uganda should therefore be very concerned and should put in place ample mechanisms and safeguards for data protection especially in the areas of data processing, data security, data localization and data sharing which are pertinent issues when dealing with mobile money services.
The other foreseeable challenge that must be countered is the potential interruption of service by the telecoms which would definitely, affect mobile money transactions whose operations are anchored on the smooth running of the telecom infrastructure and network. This is especially a unique challenge because of the fact that Bank of Uganda does not have the legal mandate to regulate the quality of service of the telecoms and tower companies that offer the technological and infrastructural support for mobile money operations. Bank of Uganda will face a challenge in holding the mobile money operators accountable for the quality of service on account of infrastructural and network related issues. Accordingly, the inter agency cooperation between Bank of Uganda, UCC and the line ministries will go a long way in having this challenge addressed.
Balancing the need to regulate and at the same time build a conducive ecosystem for growth of the mobile money technology is another potential challenge that Bank of Uganda must be alive to. Traditionally and conventionally, Bank of Uganda, is accustomed to “over regulation” of financial institutions. However, these regulatory rigidities cannot be applied squarely to mobile money operations. The reason for this is that the bloodline of mobile money operations is ICT innovation which is constantly evolving and supersonically changing. Any attempt to over regulate will stifle any further advancement into the immense opportunities that mobile money operations and services present. Accordingly, a delicate balance must be struck between conventional regulation of financial services and permitting a certain degree of open mindedness that will promote a conducive eco system for the enablement of attainment of the many possibilities through mobile money.
Conclusion
The new licensing regime is most welcomed especially because it has many provisions that seek to address the challenges highlighted above. However, I note that specifically in respect of consumer protection, the law makes general requirements like transparency, confidentiality, data protection, accountability without affording depth to these very important principles. It therefore leaves a lot of room for breach and derivation of benefit by the mobile money operators from the ambiguity and vagueness posed by the Act. Bank of Uganda therefore has a task of putting in place sufficient mechanisms for the attainment of the said principles. Bank of Uganda will also need to build relevant technical and human capacity to steadily match and catch up with the ever evolving innovation in the mobile money space. Otherwise, its role will be inconsequential and soon obsolete to the detriment of the sector. There should also be regular monitoring of the eco system both locally and internationally to ensure progressive regulation and supervision of the sector.
Disclaimer
This article provides general information only. It is not intended to provide advice with respect to any specific set of facts, nor is it intended to be relied on as legal advice.
Damalie Tibugwisa is a commercial lawyer and is the Founder and Managing Partner of M/s Tibugwisa and Co. Advocates. For comments and inquiries contact her at damalie@tadvocates.com or +256787461139 or for other services by the firm check out the firm’s website on www.tadvocates.com