Open banking API readiness for banks, SACCOs, MFIs and fintechs
Prepare your financial systems to connect safely with approved partners and new digital services. We assess your APIs, then build the secure gateway, partner onboarding and audit trail.
At a glance
- Banks, microfinance banks, SACCOs and MFIs
- Fintechs and payment service providers
- Institutions planning to open selected services to approved partners
- Access to your core banking, payment and channel interfaces
- Your IT, risk and compliance teams for the assessment and design
- Your legal advisers, for any compliance decision
- An environment in your data centre or your own cloud account
- Any WSO2 licensing or support subscription, agreed directly with WSO2
- A written API readiness and gap assessment with a prioritised plan
- A secure API gateway with OAuth2 and OpenID Connect
- Partner onboarding with keys, scopes, limits and approval steps
- An API catalogue, a developer portal and a sandbox
- Consent and audit design where legally and technically supported
- Monitoring, alerting and fraud-risk controls on partner traffic
- Runbooks and training for the team that runs the platform
Quoted after scoping
What changes
- You know which of your systems and data are ready to expose through APIs, and what has to change first.
- Approved partners reach your services through one secured, documented gateway instead of one-off connections.
- Every partner call is authenticated, limited to what was agreed and recorded for audit.
- Customer permission can be captured, checked and withdrawn where the law and your systems support it.
- Your teams can adapt the same patterns as rules in each market take shape.
What’s included
- An API readiness and gap assessment across your core, payment and channel systems
- A secure API gateway with OAuth2 and OpenID Connect, using your identity provider where you have one
- Partner onboarding with keys, scopes, limits and approval steps you control
- Consent capture, withdrawal and audit design where legally and technically supported
- An API catalogue, a developer portal and a sandbox for partners to test against
- Integration with your core banking system, payment systems and digital channels
- Security testing, monitoring, alerting and fraud-risk controls on partner traffic
- Reusable patterns and a written record of decisions, adaptable to each jurisdiction
How it runs
Readiness assessment
We inventory your systems, existing interfaces, data and partners, and review security, consent and audit, then give you a written gap assessment and a prioritised plan.
Design
API products, data models, security, consent and partner onboarding are agreed with your IT, risk and compliance teams before anything is built.
Build and test
We build the gateway, integrations, developer portal and sandbox in your environments and test them with your teams, including revoked tokens, expired consent and abusive callers.
Pilot and hand over
One partner and a small set of APIs first. Then runbooks, monitoring and training for the team that will run the platform.
Why prepare now
Kenya’s payments ecosystem is moving toward greater interoperability and more secure data sharing. Partners already ask banks, SACCOs and fintechs for access to balances, transactions and payments. Each request tends to become its own connection, with its own credentials and nobody quite sure who can see what.
We help financial institutions assess their API readiness and build secure, well-governed integration capabilities as policy and market expectations evolve. You open only what you choose, to partners you approve, on terms you can audit.
What the work covers
API readiness and gap assessment
We inventory the systems that hold the data and services partners will ask for: your core banking system, payment systems, cards, mobile and internet banking, and the interfaces they already expose. We review security, consent, audit and monitoring, and give you a written gap assessment with a plan in order of priority.
A secure gateway, partner onboarding and access control
Partners call one gateway, never your core. It validates OAuth2 and OpenID Connect tokens, applies the scopes and limits each partner agreed to, and records every call. New partners are onboarded with their own keys and approval steps you control, and can be suspended in one place.
Consent design and audit, where legally supported
Where the law and your systems support it, we design how a customer’s permission is captured, checked on every call, and withdrawn. Every access is traceable to a partner, a purpose and a permission. We build what your legal advisers confirm is required or allowed; we do not decide it for you.
An API catalogue, developer portal and sandbox
Partners find your APIs in a catalogue, read OpenAPI documentation, request access and test against a sandbox with synthetic data before they touch production.
Integration with core banking, payments and channels
Standard interfaces and data models sit in front of what you already run. We integrate through the interfaces your core banking system, payment systems and digital channels expose, follow your change process and do not modify the core itself.
Security, monitoring, testing and fraud-risk controls
API security testing before go-live. Monitoring and alerts on errors, latency and unusual partner behaviour. Fraud-risk controls on partner traffic, which can feed transaction monitoring if you run it.
Reusable patterns for each jurisdiction
Rules differ between African markets, and will keep changing. We build reusable patterns for security, consent, onboarding and audit, and adapt them to each jurisdiction’s requirements as they are confirmed, rather than assuming one country’s draft applies everywhere.
How WSO2 fits
WSO2 is a technology we work with; we do not claim partner status. Which capabilities you get depends on the version you deploy and the components you license.
- WSO2 API Manager publishes your APIs and governs their lifecycle, runs the developer portal, secures access with OAuth2, throttles each partner to agreed limits and provides analytics on API traffic.
- WSO2 Micro Integrator sits behind the gateway. It transforms messages, bridges legacy SOAP interfaces to REST, and orchestrates multi-step flows across your core and payment systems.
See WSO2 API and integration for how we deploy and hand over the platform.
Where Kenya’s policy is heading
In September 2026 the Central Bank of Kenya published, on its website, the National Treasury’s Draft National Payment System Policy (dated August 2026) and the Draft National Payment System Bill, 2026 for public consultation (CBK notice, 21 September 2026).
- The draft policy describes open finance as a third party accessing, with the customer’s permission, the customer’s data held by a payment service provider or payment system operator.
- Its section on implementing open banking and data governance frameworks proposes that Kenya develop clear open banking and data-sharing regulations, drawing on the UK and EU, so financial information can be exchanged securely and in line with data protection law.
- Among proposed government initiatives, it lists mandating open API standards for integration across financial systems, payment system operators and payment service providers; adopting national or global messaging standards; developing a national instant payment switch; and implementing a regulatory sandbox.
These are proposals in drafts for consultation. They are not law, and the final policy and bill may differ. This is not legal advice; the policy and bill are drafts. Information current as of 13 October 2026.
For a plain-English walk through the drafts and five practical readiness steps, read Kenya’s draft National Payment System Policy 2026: what it means for open banking.
Start with a readiness assessment
Tell us which systems partners will need to reach and how they are connected today. We reply with the questions that decide scope, then agree an assessment with your IT, risk and compliance teams.
Common questions
Does Kenya already have open banking regulations?
Not as at 13 October 2026. The National Treasury, with the Central Bank of Kenya, has published a Draft National Payment System Policy and a Draft National Payment System Bill, 2026 for public consultation. The draft policy proposes open banking and data-sharing rules. Drafts can change, so we help you prepare sensibly, not comply with rules that do not yet exist.
Can you tell us whether we are compliant?
No. Compliance is a legal question for your lawyers and your regulator. We assess technical readiness: your APIs, security, consent and audit capabilities, and what it would take to share data safely with approved partners.
Do we need WSO2 to do this?
No. WSO2 API Manager and Micro Integrator are technologies we work with, and they cover the gateway, developer portal and integration layers well. If you already run another API gateway, the assessment covers it, and we can work with what you have.
Will partners reach our core banking system directly?
No. Partners call the gateway. The gateway checks who is calling and what they are allowed to do, and only then calls your core through the interfaces it already exposes. Internal and administrative routes are never published.
Where does the platform run?
In your data centre or your own cloud account, so customer data stays where your policies and the law require. We plan availability and backups with your infrastructure team.
How much does an open banking readiness project cost?
It depends on the systems in scope, the number of APIs and partners and your security and availability requirements. We usually start with the readiness assessment, then give you a written scope and price for the build.
More in Financial Technology
Preparing your systems for open banking?
Tell us which systems hold the data and services partners will ask for, and how they are reached today. We scope an API readiness assessment with your IT, risk and compliance teams.