and recognized as a valid threat at every level. 2. good risk management is the foundation good risk management and good it practices set the foundation for a solid program to address cyber - related risk. it ’ s hard to imagine that a firm that doesn ’ t manage its it risk well is ever going to be able to manage cyber risk well. in fact, two areas that we recently reviewed that require attention include basic it asset management and strengthening patch and vulnerability management practices. these are necessary hygiene steps and should be a fundamental for a sound cyber security defense program. as part of good risk management, firms also need to start considering how to assess the costs of cyber and connect the pricing of cyber risk to the businesses. you must ask yourself “ what is my cyber exposure? ” and, you need to think about how you should price it, because until cyber is priced, it may not get the attention it needs. 3. it ’ s not just the banks cyber isn ’ t just about the banks – it ’ s about the entire financial sector, as well as the connections between the financial sector and other sectors like the utilities, retail, and others. we know that every area of the industry is interconnected ; and it ’ s not just financial firms. as the old saying goes, we are only as strong as the weakest link. in the financial system, that weak link could be a weak firm, a weak vendor, a weak point of vulnerability in a payments or clearing system, etc. a weakness in any of these areas exposes the entire system, because the interconnections mean that you are all linked to each other, to non - financial firms, and to every system that supports the operations and structure of the industry. the additional risk to keep in mind here is the growing number of unregulated firms operating in and competing in this arena. as the industry moves to overcome the risks associated with cybersecurity, you have to consider the additional vulnerabilities you are exposed to through non - regulated entities that will not be subject to the same guidance and standards. the big question lies in how you, as an industry, ensure that the ‘ industry as a whole ’ is safe, not just regulated entities. 4. one size does not fit all just as firms are diverse in size, complexity and product offerings, so too are technologies, processes and systems. while some firms house all technology work internally, others outsource the entire function or a significant

njuguna ndung ’ u : agent banking remarks by prof njuguna ndung ’ u, governor of the central bank of kenya, at the official opening of the workshop on agent banking, nairobi, 14 january 2010. * * * chief executives of commercial banks here present ; distinguished guests ; colleagues ; ladies and gentlemen : allow me at the outset to thank you for accepting our invitation to attend this workshop. it is indeed important that this morning we are addressing the issue of agent banking, a concept we are keen to see take root innovatively in kenya. the central bank has convened this workshop for three critical objectives : • the first objective is to demystify this new banking model and show how it works ; • secondly, to showcase how it has worked successfully in other countries as a platform for financial reach, inclusion and financial deepening ; • finally, to build consensus amongst market players on how agent banking can work in kenya supported by regulatory framework. as you are aware, the finance act, 2009 that became operational at the beginning of this month has amended the banking act to enable use of third party agents by banks. banks will therefore be able to leverage on additional cost effective distribution channels to offer financial services. this initiative is informed by the need to leapfrog access to financial services in kenya. the national financial access survey of 2009 shows that 32 % of kenya ’ s bankable population remains totally outside the orbit of financial services and many more being served by the informal financial system. ladies and gentlemen : vision 2030 is premised on a safe, efficient and inclusive financial system where savings and investment rates will more than double. the financial sector is expected to play a pivotal role in mobilizing the substantial resources required to finance the envisaged flagship projects. we must therefore explore and implement innovative models that will deepen kenya ’ s financial sector to support savings and investment growth. the central bank of kenya continues to support innovations that will broaden financial inclusion for the majority of kenyans. in doing so, we will need to focus on safeguards to ensure that the integrity and safety of the financial sector is not threatened. but above all, the cost of financial services should decline to encourage financial inclusion and reach at all corners of the country. it is appropriate at this stage to highlight the key steps that the central bank has undertaken up to now with regard to agent banking : • initially, extensive reviews of the knowledge base in this area were undertaken to enhance our understanding of this