A bank can know a great deal about its customers and still be exposed by the person sitting behind the counter, operating a system, approving a transaction or handling information that can move money in seconds.
This is not an argument against trusting employees; rather, it is an argument for recognising that trust, like risk, is not static.
Banks have spent decades building sophisticated systems to understand who their customers are, where their money comes from, what transactions they normally make and when their behaviour changes.
Know Your Customer has become fundamental to modern banking because financial institutions understand that the person or business that passed a due-diligence check yesterday may present a different risk tomorrow.
The same logic should apply to employees. Yet in many institutions, employee due diligence remains largely a recruitment exercise. A candidate is screened, references are checked, qualifications are verified, perhaps a criminal or credit check is conducted where appropriate, and the resulting information becomes part of a personnel file. Once the person is hired, however, the scrutiny often recedes into the background unless something goes wrong.
That approach made more sense when banking was slower, more physical and more compartmentalised. It makes considerably less sense in an industry where one employee can have access to multiple systems, digital channels, customer information and transaction processes, sometimes from a single workstation.
The Central Bank of Kenya’s latest Financial Sector Stability Report illustrates the broader environment in which this risk is unfolding. Reported banking fraud cases rose from 173 in 2023 to 353 in 2024, while the amount exposed increased from Sh680.9 million to nearly Sh2 billion. Losses rose from Sh412.5 million to Sh1.59 billion.
These figures do not suggest that employees are responsible for all, or even most, banking fraud. Cybercriminals, social engineering, compromised credentials and other external threats remain significant risks. But the figures underline a more fundamental point: as financial institutions become increasingly digital, the distinction between an external threat and an internal vulnerability is becoming less straightforward.
The events at Equity Bank in 2025 provided a particularly striking illustration of why this distinction matters. An internal investigation followed a major fraud in which the credentials of a manager in the bank’s salary-processing unit were used to process more than 40 transactions totalling about Sh1.5 billion.
The important lesson is not that employees should be viewed with suspicion. It is that an employee’s risk profile can change, sometimes considerably, after recruitment is complete.
Circumstances change. Financial pressures change. Relationships change. Responsibilities change. An employee who joined an institution five years ago may today have substantially greater access to systems, customers or financial processes than they did when their background was first checked. They may also have moved into a role with a very different risk profile.
The organisation, meanwhile, may have accumulated new information about their conduct, conflicts of interest, access patterns or dealings with customers.
A background check captures a point in time. It cannot, by definition, tell an institution everything that may become relevant later.
This is where Know Your Employee, or KYE, needs to evolve from a recruitment concept into an ongoing risk-management discipline.
The argument for continuous KYE is not particularly radical when viewed alongside the way banks already manage other forms of risk.
Banks do not assess a borrower once and then assume the borrower’s circumstances will remain unchanged for the life of the relationship. They monitor accounts because behaviour can change. They review transactions because patterns can change. They update customer information because circumstances can change.
Employees deserve dignity and privacy, but the institution also has a legitimate interest in understanding risks associated with positions of trust, particularly where employees have access to money, sensitive customer information, critical systems or decision-making authority.
Recent experience in the banking sector suggests that institutions are already moving in this direction, although often reactively rather than as part of a coherent KYE architecture.
KCB, for example, reported dismissing 34 employees in 2024 in cases involving fraud and professional negligence, while the bank said it had blocked hundreds of attempted fraud incidents that placed hundreds of millions of shillings at risk. Such interventions are necessary when misconduct is established, but the larger question for the industry is whether some risks can be identified earlier, before they become disciplinary cases, financial losses or reputational crises.
That requires a distinction between monitoring and surveillance.
Continuous KYE should not mean reading employees’ private lives, tracking every personal transaction or creating an industry-wide blacklist of people who have changed jobs. Such an approach would be disproportionate, intrusive and potentially harmful, particularly in a labour market where allegations can easily acquire a life of their own.
Nor should KYE become a mechanism through which an algorithm quietly decides that an employee is a risk and triggers dismissal without meaningful human scrutiny.
The more useful model is one in which KYE creates signals that warrant attention, rather than verdicts that determine a person’s fate.
An employee whose role changes significantly, for instance, may warrant a refreshed assessment of access and conflicts of interest. A person moving into a highly sensitive function may require enhanced checks appropriate to the new responsibilities.
An institution may also have legitimate reasons to review information when there is a documented conflict of interest, a substantiated compliance concern or a significant change in the employee’s circumstances that is directly relevant to the role.
The principle should be proportionality: the greater the access and potential exposure, the stronger the justification for appropriate ongoing checks.
This is not an entirely unfamiliar concept outside banking. Humanitarian organisations, for example, have increasingly recognised the need for safeguarding systems that go beyond checking a person’s history at the point of recruitment.
The reasoning is straightforward: a person who presents no known concern when hired may subsequently acquire greater authority, encounter different circumstances or behave in ways that change the organisation’s assessment of risk.
Financial institutions face a comparable challenge, albeit in a different context.
The objective, therefore, should be to build an employee-risk architecture rather than another compliance checklist. At onboarding, the institution establishes a proportionate baseline.
During employment, it maintains that baseline by reviewing relevant information when there is a legitimate reason to do so. When an employee moves into a higher-risk position, the level of due diligence can change accordingly. Where a system detects an unusual pattern, that pattern becomes a prompt for human review rather than an automatic judgement.
Technology can make such an architecture more practical, particularly as institutions already possess large amounts of data across human resources, compliance, access-management and transaction systems. But technology should serve the governance framework, not replace it.
That distinction matters because employee data is not simply another form of corporate information. In Kenya, the Data Protection Act places important constraints around how personal data is processed and gives individuals protections against decisions based solely on automated processing where those decisions have legal or similarly significant effects.
A responsible KYE system must therefore answer several questions before it asks whether technology can detect a risk: What information is genuinely necessary? Why is it being collected? How long should it be retained? Who can access it? What constitutes a meaningful alert? Who investigates it? And what opportunity does an employee have to explain information that may otherwise be misunderstood?
These questions are not obstacles to KYE. They are what make KYE credible.
The banking industry already understands the consequences of getting identity wrong. A customer who is incorrectly identified can expose a bank to money laundering, fraud, regulatory penalties and reputational damage. Yet the same institution may know relatively little about how the risk surrounding an employee has evolved since that employee was first screened.
That gap deserves greater attention.
There is also a broader lesson here about the changing nature of trust in African financial institutions. As banks digitise, expand mobile channels and rely on increasingly interconnected systems, trust is no longer secured simply by putting the right people in the right jobs. It has to be reinforced through processes that recognise how quickly circumstances can change.
This is where African financial institutions can move beyond imported compliance language and develop systems suited to the realities of the markets in which they operate.
Identity infrastructure is becoming increasingly important across the continent because institutions need to establish not merely who someone says they are, but whether the information available about that person remains sufficiently reliable for the decision being made.
For companies such as Identify Africa, which works at the intersection of identity verification, authentication and African data infrastructure, this creates an important space for innovation.
The opportunity is not to build another tool that watches employees, but to help institutions develop better ways to establish identity, validate information, and manage risk while preserving proportionality and human oversight.
The distinction is important because KYE should never become an excuse for indiscriminate surveillance. The strongest systems will probably be those that know when not to look as much as those that know when to look more closely.
A junior employee handling limited customer information should not necessarily be subjected to the same level of scrutiny as an executive with access to sensitive systems, large-value transactions or confidential institutional information. A person whose responsibilities have remained stable may require less frequent intervention than someone whose role has changed substantially.
A genuine risk-based approach recognises these differences rather than treating every employee as though they present the same level of exposure.
In that sense, continuous KYE is less about watching people and more about keeping institutional knowledge current.
It asks an organisation to resist the comforting assumption that because it once knew who an employee was, it necessarily knows who that employee is today in every way that matters to the organisation.
That is a subtle but important shift. It moves KYE away from the idea of an employee as a static file and towards the more realistic understanding that employment is a continuing relationship in which responsibilities, access, circumstances and risks evolve.
The banking sector has already accepted this principle when dealing with customers. A customer who opened an account five years ago is not treated as a permanently frozen version of the person who completed the original KYC form. Transactions provide new information. Changes in circumstances provide new information. New risks provide new information.
Employees are no different in that respect.
The challenge is to apply the lesson without losing sight of the rights, dignity and legitimate expectations of the people being assessed.
KYE must therefore be built around clear purpose, proportionality, data protection, transparency and human judgement. Its purpose should be to help institutions notice meaningful changes in risk early enough to investigate them responsibly, not to manufacture suspicion where none exists.
Ultimately, trust works best when it is neither blind nor cynical. A bank should be able to trust its employees while still maintaining the systems necessary to protect customers, shareholders and the institution itself.
KYC taught financial institutions that knowing a customer is not a one-time event. The same reasoning should now shape how banks think about the people inside their organisations.
Because the employee a bank hired five years ago may have passed every check that existed at the time. The more important question today is whether the institution still knows enough about the risks surrounding that employee to make informed decisions.
That is what continuous KYE is really about: not assuming that yesterday’s knowledge is sufficient for today’s risk.