Be wary of supply chain security risk on single payments platform

Over the years, Kenya has made significant strides in digitising its services, aiming for efficiency, transparency and accessibility.

Recently, the State centralised payment of all its levies through a new single Paybill number, setting the stage for consolidating government finances scattered across many bank accounts into one Treasury Single Account.

While this approach offers several potential benefits, including streamlined processes and enhanced user experience, it presents notable risks and challenges.

Supply chain risks, including cybersecurity threats, invoice fraud or unauthorised payments, supplier risks, data breaches, trade secrets, and sensitive information, compromising software updates, injecting malware into supply chain processes, or exploiting weaknesses in vendor systems to gain unauthorised access may pose threats to the initiative.

With increasing digitisation and interconnectedness, such vulnerabilities can have widespread implications for government agencies, critical infrastructure and the private sector.

Over the years, Kenya has grappled with corruption and mismanagement in various government departments and programmes, including efforts to enhance procurement processes and prevent fraud.

Centralising government services on a single payment platform may introduce another channel for pilferage of public funds if not well managed.

For instance, Nigeria’s Integrated Financial Management Information System, designed to streamline government financial processes, encountered several supply chain security challenges and corruption. There were reports of irregular procurement, inflated contract prices, payment delays, and misuse of funds, raising transparency and accountability concerns.

Similarly, Mexico’s Prospera programme, a replica of Brazil’s Bolsa Família and India’s Public Distribution System, faced similar supply chain risks and corruption issues. There were fraud cases, including ghost beneficiaries, falsification of documents, and state officials colluding with vendors to embezzle funds intended for beneficiaries.

Single payment platforms rely on third-party providers for various hardware components, such as servers, routers, and networking devices, which may be susceptible to compromise through hardware tampering, resulting in data breaches, service disruptions, or unauthorised access.

These pose significant risks to the single payments platform’s integrity, availability, and security. Without proper oversight and audit trails, it may be challenging to track payments and identify fraudulent activities.

For the single payment platform to succeed, the State should implement robust security measures such as encryption, access controls, regular audits, strengthen transparency and accountability measures, enhance authentication and authorisation controls, robust fraud detection mechanisms and safeguard the platform from political interference.

The writer is a procurement and contract management consultant.