Thousands of customers have lost access to their accounts and others are facing arrest, as the regime puts Myanmar’s largest private bank in a stranglehold in order to block funding to the resistance.
By FRONTIER
“I want to sell a KBZPay account Level 2. Please contact this number,” reads a post in a Facebook group created by customers of Myanmar’s largest private bank, Kanbawza, more commonly known as KBZ.
The bank’s mobile wallet, KBZPay, is used by more than six million people across the country, sectioned into different tiers – the higher the level, the more money you can transfer but the more personal information you are required to provide.
The Facebook post, which includes two screenshots of the account’s interface and a phone number, was made by Ma Thiri*, one of the group’s nearly 50,000 members, on behalf of her husband. An unemployed cook, she told Frontier they are selling the mobile wallet account and the SIM card to which it is registered because they “really need the money”.
Her post is one of hundreds, as customers look to make a quick sale off the junta’s crackdown on buying SIM cards and registering new KBZPay accounts. Some, like Ma Thiri, are selling their personal accounts, while others, like broker Ko Kyaw Hlaing*, have turned the increasing demand into a business.
“I am now doing this as a side job,” said Kyaw Hlaing, who explained he mostly facilitates sales for people like Thiri, but also sometimes buys ID cards to open new accounts to sell. “A lot of people have had their accounts suspended for various reasons and some of them contacted me to buy new accounts so it’s a win-win situation.”
Ma Thiri and her husband are selling the account and the SIM card for MMK50,000 (US$23) – the average asking price in the group.
“We started seeing this kind of ‘not necessarily legal’ trade of accounts after the recent blocking of many of the KBZPay Level 1 and also Level 2 accounts and restrictions on opening new accounts in 2022,” said Daw Wai Phyo Myint, the Asia-Pacific Policy Analyst at digital rights organisation Access Now, referring to the regime’s harsh restrictions on mobile banking.
With the devaluation of the kyat and limits on cash withdrawals following a bank run soon after the coup, mobile wallets like KBZPay have become a lifeline for many people to send and receive money. However, KBZ’s alleged cooperation with the regime has raised concerns around increased surveillance.
Tangled relations
KBZ was under European sanctions until 2012 for alleged ties to the military. These ties extended to jade mining, according to a 2019 report by a United Nations-appointed Fact-Finding Mission. More recently, in 2019, the company formed a joint venture with Thai energy firm PTT to build a fuel terminal in Yangon on land leased from a military conglomerate. KBZ divested from the mining and fuel ventures in 2021 and 2022 respectively, according to the company website.
In September 2017, when the military’s brutal “clearance operations” against the Rohingya were fully underway, commander-in-chief Senior General Min Aung Hlaing personally accepted a total of almost K3.5 billion in donations from a KBZ-linked charity. The funds, granted over two separate ceremonies, were intended for security personnel, civil servants and local residents following coordinated attacks by a Rohingya militant group that prompted the military onslaught against the Muslim minority.
While KBZ’s press office did not respond to Frontier’s numerous requests for comment, another KBZ source defended the bank’s post-coup relationship with the military regime as involuntary.
Mr Parker Lei*, a former senior marketing official at KBZ who requested anonymity, said that KBZ “really had its hands tied”, especially in the immediate aftermath of the coup. He claimed that the bank has tried to maintain a level of autonomy to avoid becoming nationalised, yet it also recognised the reality of Myanmar’s changed political environment.
“The bank was, and probably still is, in a very difficult position. There was a real civil service to what we were trying to do – we were trying to keep the financial state of the country alive. But simultaneously there was a lot of pressure from the military to do and say and be certain things,” said Lei, who claimed the military was forcing “every business in the country” to monitor dissidents.
As millions took part in mass peaceful protests across the country, Lei said that the junta even used COVID-19 preventative measures such as contact tracing to determine which KBZ employees were involved.
“Everyone was checking in through a digital online portal to say who was working, whether they had been outside, and other data around our mental health. The military was putting a lot of pressure on KBZ to give the military a list of employees who were part of the people’s movement,” said Lei.
“The bank absolutely did not want to do it, tried to stall on it as much as possible and came up with a way where employees could just choose not to come back to work without saying they were part of the people’s revolution.”
KBZ’s relationship with the military isn’t the only one that has come under scrutiny. In 2018, the bank entered into a partnership with controversial Chinese telecommunications company Huawei to develop KBZPay, which was launched the following year. But, short of a handful of press releases, very little information has been made public on the nature of the relationship.
Founded by a member of the Chinese Communist Party and former People’s Liberation Army officer, Huawei’s ties to the Chinese government and potential use as a surveillance tool has led many countries to treat the company with suspicion. In Myanmar, Huawei has reportedly supplied cameras and other equipment to companies involved in the junta’s efforts to roll out surveillance networks in major cities.
A former Huawei employee, who spoke to Frontier on the condition of anonymity, said that while KBZPay is owned by the bank, “the platform, technology and operations are overseen by Huawei, so it is very easy for Huawei to trace transactions.”
But just because Huawei could monitor these transactions doesn’t necessarily mean they are doing it. Ms Golda S. Benjamin, an Asia-Pacific Campaigner with Access Now, said that when Huawei partners with a company or bank, such as KBZ, it builds the infrastructure and cloud services and then typically surrenders all technology to the buyer to remove any accountability.
With KBZ under scrutiny in the post-coup landscape, a former senior KBZ official, Ko Zaw Oo*, said the bank may be tempted to “scapegoat” Huawei for surveillance breaches to protect its reputation, “but behind closed doors their relationship is strong.”
As evidence of these ties, U Aung Thiha*, another former senior KBZ official, said the KBZPay service fee revenue is split 60 percent to KBZ and 40pc to Huawei.
Draconian measures
Regardless of whether KBZ sought to protect customers and employees after the coup, as Lei claims, it’s clear the bank is increasingly obliged to comply with the junta’s directives. Much of the regime’s oversight of banks like KBZ comes through the Central Bank of Myanmar, which fell under the control of the military after the coup. Most of the time, the CBM communicates with banks through directives, which are rarely made public.
At KBZ, directives from the CBM are only seen by a handful of people at the highest level, said Zaw Oo.
“The directives are only sent to senior management. Sometimes the CBM asks them to provide certain customer data, but I only heard about this secondhand,” said Zaw Oo. “I wouldn’t be surprised if most of the CBM communications were not digital, but rather sent as a letter directly to the bank’s board of directors.”
Many of the directives include basic information, like updates on the value of the kyat or interest rates, but others include more draconian measures.
In August last year, the junta reportedly issued a directive – one of the few to have been leaked since the coup – ordering banks to increase their surveillance efforts by “installing CCTV or secretly taking pictures” of those buying and selling mobile banking accounts. Critically, the directive also required customers to provide additional personal information when opening or upgrading their accounts.
While none of Frontier’s sources had seen the directive firsthand, Zaw Oo said the leak appeared legitimate and that company policy changed accordingly.
Part of the directive ordered that existing Level-1 customers upgrade to Level-2 within three months, which requires customers to hand over additional personal information, including an image and video of their face. To upgrade to a Level-3 account, customers would now need to provide a resident certificate from a ward office and a police clearance form.
Zaw Oo said that following the order, KBZ began using “soft force” to push customers to upgrade their accounts and provide more personal information, even offering prizes like iPads to employees who got the most customers to level up.
Wai Phyo Myint, from Access Now, said that since the directive was issued, banks have been blocking an increasing number of Level-1 accounts that have not been upgraded.
Opening a new account also became more challenging. While a mobile banking account could previously be opened with just a phone number, since the directive was issued users also need to provide a profile picture and an image of their Citizenship Scrutiny Cards. The CSC, often referred to as the National Registration Card, is the primary identity document for Myanmar citizens containing their personal details and is essential for travel, access to education and formal employment.
“In the past, you could have several mobile banking accounts, which are registered but not necessarily with your own ID number. This meant that you could open mobile pay accounts with already-registered SIM cards that don’t have your information like your NRC,” said Wai Phyo Myint.
“But as of late 2022, the junta is actively checking whether the identification to which the KBZPay account is registered matches the identification of the SIM card. If they find that the ID doesn’t match, they will block your KBZPay account.”
So far, the junta has only been keeping tabs on SIM card registration, but Daw Htaike Htaike Aung, the executive director of digital rights group Myanmar ICT for Development Organization, said that more extreme measures may be adopted “very soon”.
She said that there has been a recent push by the regime to start tracking mobile phones through the registration of International Mobile Equipment Identity codes, numeric identifiers found inside most phones that can’t be changed.
“When we use mobile communication there are two systems that are used to detect the user. One is the SIM, which can be detected with SIM registration and the other is the device. It’s much easier for people to swap SIMs than to swap devices – this is much harder and not as financially viable,” said Htaike Htaike Aung.
She noted that in other countries that have IMEI registration, like India, the government has claimed that it’s to help locate lost or stolen phones, but in the Myanmar context it’s “purely for surveillance”.
“For the banking sector, it triangulates. There would be a SIM registration, which connects to mobile banking, and the IMEI would provide another concrete data point about who’s using this particular device. It would give much more data towards tracking individuals.”
Squeezing the resistance
All of these restrictions are seemingly aimed at one purpose: blocking funding to resistance groups – labelled “terrorists” by the regime – which formed across Myanmar in response to violent crackdowns on peaceful protests against the coup.
In a press conference in September last year, the junta’s spokesperson Brigadier-General Zaw Min Tun said new financial restrictions were mainly aimed at cracking down on fraudulent mobile payments, but were enacted also “to protect agents from being abused by the terrorists and later charged in terrorism-related crimes”.
But Wai Phyo Myint said the “main reason” the military is blocking accounts “is to control the financial support going to the anti-coup movement and activities”.
“We saw this rapidly escalate in 2022 and we have also seen it in 2023,” she said. “They find mobile payments that are being made to accounts of people who have already been arrested or they identify transactions that are support mechanisms for the revolution movement.”
Aung Thiha told Frontier that the CBM is sending KBZ as many as 300 accounts to be shut down every day. He said the number was even higher last year.
U Tun Thant*, a senior official at KBZPay, said that accounts which send multiple transactions, especially of large quantities, to the same receiver are often targeted. He also said that transactions without a description are usually flagged as suspicious.
“There’s a description box when you send a transfer where you can say why you are sending the money and they are checking accounts where there are a lot of transactions to the same account without anything in the description. They go through the data and extract accounts that they think are suspicious and they freeze the accounts and afterwards they ban them,” explained Tun Thant.
Wai Phyo Myint said that for those who have had their KBZPay accounts blocked, it’s not possible to open a new account with the same ID, even if the individual has managed to buy a new SIM card. It’s also difficult to re-open an account once it has been closed, Aung Thiha told Frontier.
“To re-open an account that has been shut down, KBZ has to send a letter to the CBM and they have to review the claim, but this takes a long time and there are some accounts that cannot be reactivated,” he said.
The only option left for many, explained Wai Phyo Myint, is to buy an account that’s registered under someone else’s name, like those being sold on Facebook, but this can be risky for the original user who could remain liable for the account’s activity.
“There are risks [that] their accounts could be misused or used in ways which could put them in trouble in the eyes of the State Administration Council,” she said, using the junta’s official name. “But at this stage, apparently, many people are too desperate to think about the risks. The asking amount for the sale of an account is relatively a lot for them.”
These days, finding your account has been blocked can be as alarming as a knock at the door in the dead of night.
Shortly after his KPZPay account was locked last year, a financial service operator in Yangon was arrested. His sister told Frontier he was accused of sending money to resistance groups and charged with money laundering and financing terrorism. His account with Wave Money, another popular financial service provider, was also locked.
“Quite often we hear from people that right before they were arrested their bank account was blocked. It’s become a sign that someone is being watched and monitored,” said Wai Phyo Myint.
*denotes use of a pseudonym for security reasons
Correction, June 21: Passages describing KBZ’s past relations with the military and donations made in 2017 have been changed to provide more detail and accuracy, and a claim by a former KBZ employee about the company sharing customers’ locations with the military has been removed because Frontier could not verify it.
