The Democratic Republic of Congo's financial sector is not adequately prepared for a new generation of AI-enabled cyberattacks, the governor of the Central Bank of the Congo (BCC) acknowledged on May 8 in Dakar, Senegal.

André Wameso made the remarks during a cybersecurity panel at an international conference on crypto assets and digital innovation organized by the Banque Centrale des États de l'Afrique de l'Ouest (BCEAO).

"I want to tell you frankly that I am afraid. I am afraid of what could happen," Wameso said during remarks broadcast on the BCEAO's official YouTube channel. He noted that the position of chief information security officer did not exist at the BCC before he took office in August 2025, and that he had introduced it as a foundational governance measure.

His remarks followed a presentation by Boston Consulting Group (BCG) at the same conference. According to the firm, the average cost of a sophisticated cyberattack has fallen from roughly $1 million in 2000 to less than $1 today, while global banks now spend nearly $45 billion annually on digital protection.

Structural weaknesses

According to BCG's cyber maturity assessment, African banks score an average of 2 out of 5, compared with a global average of 3.4. The firm also estimates that between 25% and 50% of core banking systems used across the continent are obsolete, versus 10% to 15% in the rest of the world.

BCG's 2024 BCAT assessment identified another vulnerability: fewer than 10% of the interfaces African banks use to connect their services to fintechs or other partners have advanced security protections, compared with more than 80% elsewhere. Outdated and poorly protected systems can provide easy entry points for cyberattacks now capable of automatically identifying vulnerabilities using artificial intelligence.

The BCC has nonetheless accelerated the digitalization of payments in the DRC in recent years, implementing the Digital Code and developing a national interoperability switch. The system is designed to connect payment providers while preserving a degree of monetary sovereignty and encouraging the adoption of digital payment methods. The BCC has, for instance, announced a ban on cash transactions in foreign currencies, effective April 9, 2027.

Bitcoin exposure

Wameso acknowledged that three million people in the DRC are already investing in bitcoin through digital wallets provided by telecom operators, despite the absence of a regulatory framework governing the activity. He also linked the cyber risk to the country's demographic profile — the median age is 17 — and called for major investment in digital literacy extending beyond banks and fintechs.

Other panelists expressed similar concerns. Kealeboga Masalila, deputy governor of the Bank of Botswana, said cybersecurity needed to be more clearly integrated into banking supervision and extended to technical service providers, mobile operators and fintechs, whose growing role could create systemic risk.

The threat described by Wameso is no longer theoretical. With attack costs now negligible, global cybersecurity spending running into the tens of billions of dollars, and three million Congolese already active in a largely unsupervised crypto environment, the mismatch between cyber risk exposure and institutional preparedness has become one of the most immediate financial stability challenges facing the continent.

Idriss Linge, with Ecofin Agency