Another Tale Of Two Cities: The Standard Of Care For Banks In Uganda And Kenya

There is a local saying that wisdom is like fire, if you don’t have, you borrow from your neighbour. In this piece we compare the decisions of the courts in Kenya and Uganda on the standard of care for banks aiming to borrow some proverbial wisdom after finding ourselves in Uganda, perhaps not entirely short but inconsistent.

In both Kenya and Uganda, thieves have used little more than a handset and an identity card to walk through a bank’s digital front door, register as the customer, and drain the account before anyone noticed. Who bears the loss? The customer who lost the phone or the bank?

Two courts looked at almost identical facts and reached opposite conclusions. In James Njoroge v Stanbic Bank Kenya, the bank carried the loss; in Nakku Joweria v Stanbic Bank, the customer did. Both cases involved stolen phones, self-registration, and rapid withdrawals from accounts with no meaningful prior digital activity. The contrast makes a revealing test of what reasonable care now demands of banks.

The Kenya case: Njoroge v Stanbic Kenya

The plaintiff was a long-standing customer who had never used digital banking. After his phone and identity document were stolen, fraudsters exploited the bank’s self-registration process to create a new profile and to execute three unauthorised transfers within minutes.

The court held that the bank’s duty of reasonable care extended to the security of a newly activated digital channel. The self-registration process relied on information and a one-time code available through the stolen device, yet it allowed a major change to a long-standing offline account without stronger verification. The court correctly treated that design failure as distinct from the customer’s later reporting delay.

Three rapid transfers immediately after onboarding should have been recognised as an anomaly and flagged or held, consistent with Diamond Trust Bank Kenya v Kariuki. The court’s approach, reinforced by the gatekeeping principle in Family Bank v Kiarie, places responsibility on the party that controls the relevant technology. That is commercially sound: authentication proves only that credentials were used, not that the customer authorised the transaction. Nor does it require inquiry into every ordinary payment. It requires proportionate controls where a dormant account acquires a new digital profile and immediately generates rapid transfers.

The court also drew on the striking metaphor from Kiarie: "A bank is the keeper of the gate through which its customer's money passes; where it is warned that the gate stands open and does not close it, it cannot afterwards be heard to say that the thief carried the right key." That image captures the essence of the bank's obligation. In Njoroge, the gate was not merely open; it was unguarded.

The Uganda case: Joweria Nakku v Stanbic Bank

Nakku reached the opposite result. Its reasoning placed decisive weight on the compromised credentials and on the customer’s failure to notify the bank promptly, while giving too little weight to what the bank’s own systems should have recognised.

The plaintiff’s savings account had been effectively dormant, with no digital transaction history. After her phones were lost, fraudsters exploited self-registration. Multiple failed enrolment attempts were followed by 28 withdrawals through unfamiliar lines within 24 hours.

The court found no breach and concluded that the failed enrolments and unusual withdrawals did not, without more, make the transactions suspicious. That conclusion is difficult to reconcile with ordinary fraud controls. The combination of a dormant account, a new digital channel, repeated enrolment failures, unfamiliar numbers, and 28 rapid withdrawals supplied multiple specific indicators of account takeover.

The Quincecare threshold should not be treated as a licence to ignore obvious infrastructure risk. The question was not whether every unusual transaction required refusal, but whether a competent bank should have paused, verified, or monitored this sequence before allowing further loss. By treating the customer’s delayed notice as effectively dispositive, the judgment underweighted the bank’s independent duty to build systems capable of detecting foreseeable abuse.

Justice Mubiru’s standard: behavioural biometrics

In Barclays Bank v Eron Kabachwamba, Mubiru J described a comprehensive duty on banks to provide secure digital infrastructure, including technical, operational, and security measures across the digital ecosystem. The judgment also recognises complementary customer duties and a high threshold before a bank must depart from an authorised mandate.

Most importantly, the judgment identifies behavioural biometrics as an advanced control: continuous analysis of customer behaviour can identify anomalous activity in real time. That standard speaks directly to a dormant account that suddenly adopts a new channel and generates high velocity withdrawals.

The Nakku court did not fully consider Kabachwamba. It applied a Quincecare-type threshold analysis without reference to the more rigorous infrastructure standard set by Mubiru J. The omission matters because the standard addresses the systems that should detect behavioural anomalies before fraud is completed.

The Nakku court's reasoning is a giant step backwards from the more rigorous approach Mubiru J articulated in Kabachwamba. Banks are expected to deploy behavioural biometrics capable of detecting anomalies in real time.A failure to detect 28 transactions on a dormant account within 24 hours is a breach of the duty of care.

What customers must do

If a phone or other device linked to banking is lost or stolen, notify the bank and the telecommunications provider immediately, document the report, and obtain written confirmation. Blocking a SIM card or reporting the theft to the police is not enough. Prompt notice to the bank gives it a greater chance to intervene and demonstrates the customer’s own diligence.

Banks must raise their game

Banks are the gatekeepers to the customer’s money, and eternal vigilance is the price of that role. Thieves never sleep, and neither should the systems guarding the gate. Banks must ensure stronger identity checks and monitor for activation on dormant accounts, rapid or numerous transactions, and failed enrolment attempts followed by success. Real-time monitoring, multi-factor authentication, and behavioural biometrics are now baseline safeguards for digital channels, not optional enhancements.

The Bank of Uganda’s discredited Consumer Protection Guidelines

The Bank of Uganda’s Consumer Protection Guidelines have been dismissed by the courts as lacking the force of law. If the Bank of Uganda were to reform the guidelines and issue a statutory instrument, it could prescribe banks’ technological responsibilities and spare customers from reliance on general duty of care principles alone. After all, Bank of Uganda’s core duty in this case is to protect depositor’s funds.

Conclusion

Njoroge and Nakku expose a common risk but divergent judicial responses. Reasonable care must reflect the technology available: customers should report compromised devices promptly, but banks should not rely on authentication or delayed notice to excuse preventable system failures. Courts and regulators alike should require secure onboarding and transaction monitoring proportionate to the now common risks of digital banking.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.