MasiboLaw

Kenya’s financial sector faces major change with the draft Central Bank of Kenya (Non-Deposit-Taking Credit Providers) Regulations, 2025. Unlike earlier rules for digital lenders like Tala and Branch, this regulation expands CBK oversight to all non-deposit-taking credit businesses, including asset financiers such as Mogo.

In this article, we break down the critical provisions of these Regulations and what they mean for lenders, investors, and consumers.

Licensing of Non-Deposit-Taking Credit Providers

Businesses with capital above KSh 20 million are required to obtain a CBK licence. This ensures that only credible, compliant, and well-governed providers operate within Kenya’s credit market.

Licence application requirements include:

• Proof of capital (e.g., bank statements).
• Compliance with consumer protection and data protection laws (including registration with the Data Protection Commissioner).
• Evidence of robust governance and management frameworks.

Licences remain valid unless suspended or revoked and are subject to annual fees and conditions imposed by CBK. Applications may be discontinued if a provider fails to respond to CBK inquiries within three months.

Registration of Smaller Credit Providers

Providers with less than KSh 20 million in capital must register instead of getting a full licence—reflecting a lighter approach for smaller operators.

Registration requirements include:

• Proof of capital.
• Product descriptions and compliance with AML/CFT, consumer protection, governance, and data protection laws.

Registered providers must pay annual fees by 31 December each year. Undervaluing capital to avoid licensing is expressly prohibited.

Conversion to a Licence

If a registered provider’s capital, borrowings, or loan book exceed KSh 20 million, or through CBK direction, they must convert to a full licence. Once licensed, the registration automatically lapses, and the change is published in the Gazette.

Operation of Non-Deposit-Taking Credit Providers

The Regulations outline strict operational standards, including:

• Publication: CBK will list all licensed or registered providers in the Gazette and on its website.
• Non-transferability: Licences/registrations cannot be transferred without CBK approval.
• Fit-and-Proper Requirements: CBK must clear shareholders, directors, and senior officers.
• Governance: Strong internal controls, clear separation of roles, and record-keeping are mandatory.
• Permissible Activities: Loan provision, asset financing, BNPL, guarantees, and CBK-approved services.
• Prohibited Activities: Deposit-taking, membership fees, forex/remittance services, and trustee functions are banned.
• Risk Management: Providers must maintain frameworks covering credit, operational, compliance, IT, and liquidity risks.
• Credit Policy: Detailed policies are required for loan pricing, approvals, restructuring, and write-offs.
• Debt Collection Rules: Harassment, threats, shaming, or hidden fees are prohibited.
• Confidentiality & Data Protection: Customer data must be kept secure and used only with consent or as lawfully required.

Consumer Protection Under the 2025 Regulations

These Regulations fully incorporate the Consumer Protection Act to safeguard borrowers:

• Borrowers must receive timely receipts and free loan statements outlining balances, interest, and fees.
• Loan terms—including amount, interest, repayment schedule, fees, collateral, and default conditions—must be disclosed before signing.
• Borrowers must be informed of their rights and provided CBK contact details.
• Debt recovery must be respectful—no harassment, shaming, or seizure of essential personal items.
• Collateral enforcement and guarantor actions must be fair and lawful.
• Providers must maintain a complaints-handling system, with resolution by 30 days.

AML/CFT Compliance

The Regulations impose stringent anti-money laundering (AML) and counter-terrorism financing (CFT) obligations:

• Providers must verify all sources of injected capital.
• Conduct full customer due diligence on all borrowers under the Proceeds of Crime & Anti-Money Laundering Act (2025) and Prevention of Terrorism Act (2012).
• Maintain AML/CFT frameworks and report suspicious transactions.
• Non-compliance may result in severe penalties, including fines and imprisonment.

Reporting & Oversight by CBK

Licensed and registered providers must submit periodic reports on:

• Loan statistics, borrowings, agents, ownership, and audited accounts.
• Customer complaints, non-performing loan ratios, and compliance status.

CBK has wide supervisory powers, including audits, mandatory directives, and on-site inspections.

Code of Conduct & Enforcement

All NDT providers must adopt a Code of Conduct emphasizing:

• Fair and transparent consumer interactions.
• Sound business practices, integrity, and accountability.

Violations may result in administrative sanctions, fines, licence revocation, or suspension.

Transition & Repeal of 2022 Digital Credit Regulations

• Existing digital credit providers must apply for the new licence within six months of enactment.
• The 2022 Digital Credit Providers Regulations will be repealed; existing licences and rights carry over into the new framework.

Comparative Analysis: Key Changes in 2025

The 2025 Regulations bring significant updates:

• Broader scope to include all non-deposit-taking credit providers, beyond digital lenders.
• Introduction of a two-tier system: licensing for large providers, registration for smaller ones.
• Enhanced governance rules, including mandatory physical offices and expanded disqualification criteria.
• Stronger consumer protection, especially regarding debt recovery and disclosure.
• Higher penalties (fines up to KSh 2 million or 3× gains).
• Expanded CBK oversight, including approval of products, pricing, and delivery channels.

Final Thoughts

The CBK Non-Deposit-Taking Credit Providers Regulations, 2025 represent a pivotal shift in Kenya’s lending regulation. Compliance is now essential for market access and operational continuity.

At MasiboLaw LLP, we advise financial institutions, fintechs, and lenders on navigating CBK licensing, compliance, and consumer protection frameworks.

For expert advice tailored to your business, don’t hesitate to contact MasiboLaw LLP today.