Kenya’s recycled SIM rules target privacy risks for banks and mobile money users
A mobile phone number can remain attached to a bank account, a payment service or an online profile long after its original owner stops using it.
When a telecommunications operator assigns that number to someone else, messages intended for the previous subscriber can reach a stranger, creating a risk of personal information being exposed.
Kenya’s Communications Authority (CA) is proposing a central database that would help service providers establish whether a mobile number has changed ownership before sending messages to it. The plan targets a gap between telecommunications operators, which manage number reassignment, and banks, fintech companies and messaging providers that may continue using outdated customer contact records.
The proposal forms part of wider changes to Kenya’s rules for inactive SIM cards, including longer periods before numbers can be recycled and stronger requirements for handling the previous subscriber’s personal data. Its effectiveness will depend on how reliably operators update the database and whether businesses check it before sending sensitive messages.
How the recycled-number database will work
The proposed database would allow third-party value-added service providers to check whether a mobile number has been recycled before sending messages to it. Telecommunications operators would submit lists of deactivated and recycled numbers to the regulator every three months to support the verification process.
The CA said in its response to public comments that querying the database would help ensure messages reach the rightful owner of a number. The mechanism is intended to address cases where businesses continue using contact details that were valid when a customer registered but have since changed hands.
The risks extend beyond ordinary promotional messages. A bank could send transaction alerts to a number now held by another person, while a service that relies on one-time passwords or SMS-based account recovery could expose an authentication message to someone who has no connection to the original account holder.
A central database could help providers identify reassigned numbers before sending these messages, but it would not automatically remove old numbers from customer profiles or unlink them from financial and online accounts. Businesses would still need reliable account-update procedures, secure recovery processes and accurate customer records.
The proposal resembles the United States Federal Communications Commission’s Reassigned Numbers Database, which helps eligible callers check whether a telephone number has been reassigned since a specified date. Kenya’s system would need clear rules on access, data accuracy and how providers should act when a number is flagged as recycled.
New safeguards follow court ruling on inactive SIM cards
The database is one part of the CA’s proposed changes to the management of inactive mobile lines. Under the proposal, a number could become eligible for deactivation after three months without revenue-generating activity. The subscriber would then have a further three months to reactivate the line before it could be recycled.
The proposed rules would also require operators to give advance notice. Thirty days before the relevant period expires, they would publish lists of numbers due for deactivation through their websites, national newspapers and other media channels.
These measures follow a court ruling on the risks of recycling inactive numbers without sufficient safeguards. The case raised concerns about subscribers whose lines remain inactive for reasons beyond their control and the possibility that a new holder could gain access to information linked to the previous owner.
The CA’s proposals also address people in custody who may be unable to maintain activity on their mobile lines. The Commissioner-General of Prisons would facilitate exemptions for eligible inmates, including remand prisoners whose circumstances could prevent them from using their SIM cards for extended periods.
The proposed data-handling requirements are equally important. Before a number is reassigned, operators would be expected to delink or archive the previous subscriber’s personal data to reduce the risk that a new holder inherits access to information associated with the old account.
The final rules will determine how these safeguards operate in practice, including the procedures for notifying subscribers, handling exceptions and confirming that information associated with a previous number holder is no longer accessible to the next subscriber.
Banks and fintech firms face new compliance obligations
The proposal has implications for banks, savings and credit cooperative organisations, mobile money providers, fintech firms and companies that send bulk messages on behalf of businesses. These organisations often depend on mobile numbers for transaction notifications, customer engagement and account verification.
The CA has also proposed that newly issued and recycled numbers should be excluded from marketing messages by default. Operators would be required to remove recycled numbers from existing business-to-consumer messaging services where the previous subscriber had opted in.
The regulator rejected a proposal for subscribers to notify their contacts by SMS when their numbers change ownership, citing privacy concerns. Such a process could expose information about the former subscriber or create confusion about who currently controls the number.
A central verification mechanism offers a way to identify reassigned numbers without requiring the previous owner to disclose personal details to contacts or service providers. However, its practical value will depend on whether providers check the database before sending sensitive communications and what they are required to do when a match indicates that ownership has changed.
Businesses may also face technical and operational costs as they adapt their systems to the proposed requirements. Telecommunications operators would need to maintain accurate reassignment records, while banks and other service providers may need to integrate verification checks into messaging, authentication and customer-management systems.
The rules will need to clarify how often providers should check the database, which types of messages require verification and how organisations should handle numbers identified as recycled. These details will be particularly important for one-time passwords, account recovery requests and financial alerts, where sending a message to the wrong person can have consequences beyond unwanted communication.
What the proposed rules mean for mobile subscribers
For mobile subscribers, longer deactivation periods and advance notices could provide more time to retain a number or reactivate an inactive line. The proposed restrictions on marketing messages could also reduce the amount of promotional communication sent to people who acquire recycled numbers.
The safeguards do not remove the need for customers to update their contact details with banks, mobile money providers and other services when they stop using a number. A number may remain linked to an account even after a telecommunications operator has reassigned it, so account holders should follow each provider’s procedures for changing registered contact details.
For service providers, the database would offer a shared way to identify changes in number ownership, but it would need accurate and timely information to be effective. Quarterly reporting, for example, may leave a gap if a number is reassigned before the latest records are available, making the final update and verification requirements important.
Mobile numbers are a finite telecommunications resource, and operators must manage inactive lines so they can be returned to circulation. The regulatory challenge is to make that process work without exposing former subscribers’ information or allowing outdated contact records to undermine the security of financial and online services.
Kenya’s proposed database addresses one part of that problem by connecting number reassignment records with the organisations that use mobile numbers to communicate with customers. Whether it provides meaningful protection will depend on implementation, data quality and the safeguards businesses maintain around their own accounts and messaging systems.
Real ESG impact doesn’t happen in panels alone, it happens in the rooms where financiers, operators, and policymakers actually align. Our GreenShift Forum 2026 cuts the noise, bringing together the people rewiring Africa’s sustainability and energy frameworks for one focused day in Nairobi. Secure your seat.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to info@techtrendsmedia.co.ke
