FIA becomes Africa’s first to earn ISO 27001 certification

Kampala, Uganda | THE INDEPENDENT | Uganda’s Financial Intelligence Authority (FIA) has become the first financial intelligence unit in Africa to obtain ISO/IEC 27001:2022 certification, strengthening its capacity to protect sensitive financial information used in the fight against money laundering, terrorist financing and illicit financial flows.

The achievement was made public on Thursday, October 29, at the FIA headquarters in Kampala during a ceremony overseen by Henry Musasizi, the Minister of Finance, Planning and Economic Development alongside other government officials.

The authority also launched a new Client Service Charter intended to improve accountability, transparency and service delivery to the institutions and individuals it works with.

The ISO certification, attained in September 2026, provides independent recognition that the FIA’s information security management systems meet an internationally recognised standard.

The framework covers how organisations identify information security risks and protect data against unauthorised access, loss and other threats.

For the FIA, which receives, analyses and shares financial intelligence with law enforcement agencies and other stakeholders, protecting the confidentiality and integrity of information is central to its work.

Executive Director Samuel Were Wandera said the certification demonstrated that the authority’s information technology systems had met international standards following a rigorous assessment.

“It took us a year to attain this certification,” Wandera said.

The FIA produces intelligence reports that support investigations into suspected financial crimes and shares them with relevant stakeholders. Wandera said the ability to exchange such information depended on confidence that the systems handling it were secure.

The certification, therefore, strengthens the assurance given to reporting institutions, investigators and international partners that sensitive information entrusted to the authority is handled under established security controls.

The exercise was supported by the National Information Technology Authority-Uganda (NITA-U) and the World Bank through the Uganda Digital Acceleration Project, which is helping strengthen digital infrastructure and information security across public institutions.

John Tumusiime, NITA-U’s acting director for information security services, said the authority assessed institutions based on their information security maturity, organisational readiness and technical capacity when identifying beneficiaries for support.

He said the FIA stood out in the assessment process and received funding to undertake the certification exercise.

The wider project is supporting other public institutions, including the Petroleum Authority of Uganda, Public Procurement and Disposal of Public Assets Authority, Insurance Regulatory Authority, Personal Data Protection Office and National Drug Authority, among others.

The Uganda Digital Acceleration Project has a total funding envelope of $160 million from the World Bank, with support directed at strengthening digital services and information security.

Musasizi said secure digital infrastructure had become an important economic enabler, with implications for investor confidence, productivity and the cost of doing business.

He emphasised that the FIA’s responsibility to handle sensitive financial intelligence made confidentiality, integrity and availability of information essential to national security and economic stability.

The certification also comes as Uganda prepares for the Financial Action Task Force’s (FATF) 2028 mutual evaluation, which will assess the country’s anti-money laundering and counter- terrorism financing framework.

Uganda was removed from the FATF grey list in 2024 after addressing deficiencies identified in its financial crime prevention systems. Maintaining that progress will require continued coordination among regulators, financial institutions, law enforcement agencies, prosecutors and the judiciary.

Beyond having appropriate systems in place, the country will need to demonstrate that financial intelligence leads to effective investigations, prosecutions, targeted financial sanctions and recovery of proceeds of crime.

The FIA’s new Client Service Charter is intended to strengthen the authority’s relationship with reporting institutions and other stakeholders by setting out service standards, timelines, channels for complaints and mechanisms for measuring performance.

The charter is expected to provide clearer expectations for organisations that submit information to the authority and those that rely on its services.

Together, the certification and charter represent two aspects of the FIA’s institutional responsibilities: safeguarding the sensitive information it receives and improving the way it serves the organisations that support Uganda’s financial crime prevention system.