Skip to main content
    Live Statutory & Regulatory Sentinel
    Open Statutory Compliance Hub
    CBK Monetary Policy•Central Bank Rate (CBR) & 91-Day T-Bill Benchmark

    ALCO spread +835 bps over 4.4% YoY inflation. Deploy surplus liquid reserves into 91-Day T-Bills (15.65%) while stress-testing Stage 2/3 loan books against +200 bps scenarios.

    Run Rate Shock Stress Test

    Android Mobile Banking APK & CBK DCP Statutory Compliance Auditor

    Evaluate SACCO M-FOSA and CBK Digital Credit Provider (DCP) Android releases across cryptographic APK signing schemes, ODPC Data Protection Act 2019 permission minimization, TLS 1.3 SPKI pinning, and Flutter/DEX binary hardening.

    CBK DCP • SASRA Cyber • ODPC Act 2019 Mobile APK Auditor

    Android Mobile Banking APK & CBK DCP Statutory Compliance Auditor

    Audit APK v1/v2/v3 cryptographic signing, ODPC permission minimization (READ_CONTACTS / READ_SMS), TLS 1.3 certificate pinning, and Flutter/R8 binary hardening prior to CBK or SASRA inspection.

    Imarika DT-SACCO M-FOSA — CBK/ODPC Mobile APK Audit Briefing

    Executive Voice
    35s Executive Synthesis · APK Signature, ODPC Privacy & TLS Pinning

    Voice playback isn't supported in this browser. Read the transcript below instead.

    1. APK Binary & Manifest Telemetry

    Drag AndroidManifest.xml or package.json here
    Permissions, package ID & framework parsed locally.
    100% In-Browser · Zero Data Leaves Your Device (ODPC §41)
    Active Mobile App Members68,000 members
    Monthly Mobile Loan / FOSA VolumeKES 420M / mo
    2. ODPC Privacy & MASVS Binary Controls
    CBK / SASRA Readiness
    72/100
    CONDITIONAL APPROVAL (B)
    Statutory + Fraud Exposure
    KES 15.07M
    ODPC Fine Risk: KES 6.00M
    Recommended Audit Retainer
    KES 380,000
    39.7x Risk Protection ROI

    4-Pillar Regulatory & MASVS Scorecard

    ODPC & CBK DCP Permission Minimization70/100 • CONDITIONAL
    ODPC Act 2019 §25 & CBK DCP Reg. §20

    Manifest contains high-risk PII permissions (READ_CONTACTS / READ_SMS) subject to ODPC enforcement.

    TLS 1.3 Pinning & Transport Security60/100 • NON_COMPLIANT
    SASRA Cyber Guideline §5.1 & MASVS

    Missing SPKI certificate pins or cleartext HTTP allowed on mobile API channels.

    APK Cryptographic Signing & Lineage78/100 • CONDITIONAL
    SASRA Cyber Guideline §4.2

    Legacy v1 JAR signing exposure or missing v3 key rotation lineage.

    Binary Hardening & Secret Isolation85/100 • COMPLIANT
    CBK DCP IT Audit & OWASP MASVS

    Symbols stripped, secrets isolated at Edge, and runtime attestation active.

    Static APK Compliance Findings (4)

    ke.co.imarikasacco.mobile
    MEDIUMev_apk_sig_002
    SASRA Guideline on Cyber & Information Security §4.2

    v1+v2 Hybrid Signature Without v3 Key Rotation Lineage

    APK includes v2 block signing but omits v3 key-rotation proof-of-rotation structures and retains legacy v1 fallback.

    Remediation: Enable APK Signature Scheme v3 and set minSdkVersion >= 24 to deprecate v1 JAR signing fallback.
    HIGHev_apk_odpc_002
    Kenya Data Protection Act 2019 §25(c) (Data Minimization) & Google Play Financial Services Policy

    Broad SMS Inbox Access (android.permission.READ_SMS)

    App requests full READ_SMS inbox access instead of scoped SMS User Consent / SMS Retriever API for M-Pesa and OTP verification.

    Remediation: Migrate OTP and M-Pesa confirmation parsing to the Android SMS Retriever API (zero READ_SMS permission required).
    HIGHev_apk_net_001
    CBK Prudential Guideline on Cybersecurity & OWASP MASVS-NETWORK-2

    Missing SSL/TLS Certificate Pinning on Core Banking & Daraja Gateways

    network_security_config.xml and OkHttp/Dio client layers do not enforce SHA-256 SPKI public-key pins, allowing MITM proxy interception on untrusted Wi-Fi networks.

    Remediation: Configure SHA-256 public key pinning in res/xml/network_security_config.xml with backup leaf/intermediate pins.
    MEDIUMev_apk_bin_002
    OWASP MASVS-RESILIENCE-1

    No Runtime Root / Instrumentation Integrity Assertion

    App does not verify Play Integrity API / Magisk / dynamic instrumentation state prior to high-value FOSA/M-Pesa disbursements.

    Remediation: Integrate Google Play Integrity API attestation and block high-risk B2C disbursements on compromised runtimes.

    REA Static `.sqlite-wal` & `.NET` CIL Local Storage Forensics (ODPC §41)

    Modeled on morluto/rea src/sqlite/ & src/dotnet/ static inspection of uncommitted SQLite Write-Ahead Log frames and back-office CIL user-string heaps.

    WAL Exposure: +KES 3.50M ODPC Risk
    data/data/ke.co.imarikasacco.mobile/databases/fosa_member_ledger.db-walSQLITE_WAL_FRAME • CLEARTEXT_PII_EXPOSED

    Uncommitted WAL frames retain cleartext National ID, M-Pesa MSISDN, and BOSA loan balance after session logout.

    ODPC §41 Remediation: Migrate Room/SQLite to SQLCipher AES-256 derived from Android Keystore and execute PRAGMA wal_checkpoint(TRUNCATE) upon logout.
    data/data/ke.co.imarikasacco.mobile/shared_prefs/daraja_stk_session.xmlSHARED_PREFS_XML • CLEARTEXT_PII_EXPOSED

    Unencrypted XML stores cached CheckoutRequestID and member bearer refresh token.

    ODPC §41 Remediation: Wrap all local session preferences in Jetpack Security EncryptedSharedPreferences backed by hardware Keystore.
    BackOffice.SaccoCore.Host.dll (.NET CIL Metadata Stream)DOTNET_CIL_ASSEMBLY • SQLCIPHER_ENCRYPTED

    CIL assembly metadata hardened; connection secrets injected via HSM/Vault environment bindings.

    ODPC §41 Remediation: Remove static #US string literals from .NET middleware assemblies and load credentials from Cloudflare Secrets Store / Vault.

    Boardroom Remediation Brief & Verification Command

    Subject: Imarika DT-SACCO M-FOSA (ke.co.imarikasacco.mobile): CBK/ODPC Mobile APK Readiness Score 72/100

    Static compliance inspection of Imarika DT-SACCO M-FOSA (ke.co.imarikasacco.mobile) across 68,000 active mobile members indicates a 72/100 CBK/SASRA Certification Readiness Score (CONDITIONAL APPROVAL (B)). Remediating 2 high-priority findings protects approximately KES 15.07M in combined ODPC statutory penalty exposure and annual API fraud risk.

    Standard Android SDK Signature & Permission Verification Command
    apksigner verify --verbose --print-certs ke.co.imarikasacco.mobile.apk && aapt2 dump permissions ke.co.imarikasacco.mobile.apk