By Meshack Masibo

Kenya remains one of the most innovative financial markets globally—from the introduction of M-Pesa in 2007 to the explosive growth of mobile lending platforms such as M-Shwari, KCB M-Pesa, Tala, and hundreds of digital-first credit startups.

To enhance consumer protection, improve governance, and create stability in the credit market, the Business Laws (Amendment) Act, 2024 and the draft Central Bank of Kenya (Non-Deposit-Taking Credit Providers) Regulations, 2025 have introduced a transformative regulatory framework.

Under this new regime, digital lenders are now formally categorised as Non-Deposit Taking Credit Providers (NDTCPs)—a category that also includes asset financiers, BNPL providers, micro-lenders, and peer-to-peer credit platforms.

This guide explains how to obtain the NDTCP licence or registration and what the new legal environment requires of lending businesses in Kenya.

1. The Legal Framework Affecting Credit Providers

1.1 Central Bank of Kenya Act (Amended by the 2024 Act)

Key updates include:

✔ Replacement of the term Digital Lender with Non-Deposit Taking Credit Provider (NDTCP)

This brings under CBK regulation:

• Digital loan apps
• BNPL providers
• Peer-to-peer lending platforms
• Asset financiers (e.g., Mogo)
• Any business issuing credit without taking deposits

✔ Mandatory CBK Licensing or Registration

NDTCPs must now either:

• Apply for a full CBK licence, OR
• Register with CBK, depending on capital size

✔ Strict Consumer Protection

All NDTCPs must:

• Clearly disclose all loan terms.
• Obtain explicit borrower consent.
• Comply with data protection rules.
• Follow a CBK Code of Conduct
• Avoid harassment or shaming in collections.

2. The Draft CBK NDTCP Regulations, 2025: A New Two-Tier System

The 2025 Regulations introduce a two-tier regulatory model:

2.1 Tier 1: Full CBK Licence (Capital ≥ KSh 20 Million

Businesses with capital above KSh 20 million MUST obtain a full licence.
This targets medium- to large-sized providers such as asset financiers, major digital lenders, and BNPL platforms.

Licensing Requirements

Applicants must submit:

• Proof of capital (bank statements, audited accounts)
• Fit-and-proper documents for directors, shareholders & management
• Governance, AML/CFT, and risk frameworks
• Data Protection compliance evidence
• Consumer protection policies
• Credit pricing and loan management policies
• Evidence of physical office presence

Licences remain valid indefinitely unless:

• Suspended
• Revoked
• Conditions of operation are violated

Failure to respond to CBK requests within three months may result in automatic application discontinuation.

2.2 Tier 2: Registration for Small Providers (Capital < KSh 20 Million)

Smaller providers do not need a licence but MUST register with CBK.

Registration Requirements

• Proof of capital
• Product descriptions
• AML/CFT compliance
• Consumer protection & data protection measures
• Governance & management structure

Registered NDTCPs must:

• Pay annual fees by 31 December
• Maintain truthful capital declarations (undervaluation is prohibited)

2.3 Mandatory Conversion From Registration to Licensing

An NDTCP must upgrade to a full licence if:

• Capital exceeds KSh 20 million
• Loan book or borrowings exceed KSh 20 million
• CBK directs conversion

Once licensed, registration automatically lapses and is gazetted.

3. The Licensing/Registration Process in Four Stages

The step-by-step procedure remains as follows:

Stage 1 — Name Approval

Reserve a unique company name with the Business Registration Service.
Choose a name aligned with your target market (e.g., SME-Pesa for SME-focused lending).

Stage 2 — High-Level Business Brief

Submit a concept note detailing:

• Business model
• Target market
• Delivery channels (App, USSD, web)
• Unique value proposition
• Source of funds declaration

This demonstrates intent and capacity.

Stage 3 — Application to CBK

Submit your complete NDTCP application with:

• Fit & Proper Forms for directors & key officers
• Data protection policy & compliance proof
• Agreements with MNOs or API partners
• Governance, disputes, credit, and risk-management policies
• Terms & Conditions for users
• AML/CFT frameworks
• Proof of capital

Most rejections occur here due to incomplete documentation.

Stage 4 — Reporting Simulation & Licensing

If CBK is satisfied:

1. You undergo a dry-run of regulatory reporting
2. Pay the licensing fee (KSh 20,000)
3. Receive your NDTCP Licence or Registration Certificate

4. Operational Rules Under the 2025 Regulations

Key operational obligations include:

✔ Publication

CBK will publish all licensed/registered providers in the Gazette and on CBK’s website.

✔ Non-transferability

Licences and registrations cannot be transferred without CBK approval.

✔ Fit-and-Proper Checks

Mandatory for:

• Shareholders
• Directors
• Senior management

✔ Governance & Internal Controls

Providers must maintain:

• Clear board/management roles
• Strong record-keeping systems
• Internal audit and compliance functions

✔ Permissible Activities

Licensed NDTCPs may conduct:

• Credit issuing
• BNPL services
• Asset financing
• Credit guarantees
• Other CBK-approved activities

❌ Prohibited Activities

NDTCPs may NOT:

• Take deposits
• Charge membership fees
• Conduct forex or remittance businesses
• Perform trustee functions

✔ Risk Management

Providers must maintain frameworks covering:

• Credit risk
• Operational & IT risk
• Liquidity risk
• Compliance risk

5. Consumer Protection Obligations

Borrowers must receive:

• Free loan statements
• Receipts for transactions
• Full disclosure of:
  • Loan amount
  • Interest
  • Repayment terms
  • Fees
  • Collateral
  • Default consequences

Other protections include:

• Respectful collections (no harassment, shaming, or threats)
• Fair collateral enforcement
• Complaints resolved within 30 days
• Clear display of CBK’s contact information

6. AML/CFT Requirements

Under the Proceeds of Crime and Anti-Money Laundering Act (2025):

NDTCPs must:

• Verify all capital sources
• Conduct full customer due diligence
• Maintain AML/CFT frameworks
• Report suspicious transactions

Non-compliance may lead to:

• Heavy fines
• Imprisonment
• Licence revocation

7. Reporting & CBK Oversight

Providers must file periodic reports covering:

• Loan book position
• Ownership
• Borrowings
• Non-performing loans
• Customer complaints
• Agent networks
• Audited financial statements

CBK may conduct:

• On-site inspections
• System audits
• Mandatory directives

8. Code of Conduct & Enforcement

All credit providers must adopt a CBK-approved Code of Conduct emphasizing:

• Fair treatment
• Integrity
• Transparency
• Ethical collections

Sanctions include:

• Administrative penalties
• Fines up to KSh 2 million or 3× the gain
• Licence suspension or cancellation

9. Transition Arrangements

• Existing digital lenders must comply within six months after the Regulations come into force.
• The 2022 Digital Credit Providers Regulations will be repealed.
• Existing licences migrate automatically into the new framework.

10. Summary: Entering Kenya’s Modern Regulated Lending Market

To operate legally in 2025 and beyond, you must:

If Capital ≥ KSh 20 Million

➡ Apply for a full CBK NDTCP licence

If Capital < KSh 20 Million

➡ Register as a small NDTCP

All Providers Must

✔ Incorporate a Kenyan company
✔ Comply with data protection
✔ Maintain governance and AML frameworks
✔ Follow strict consumer protection rules
✔ Submit CBK reports and undergo supervision

Kenya’s new regulatory environment is designed to promote trust, stability, and responsible lending—while giving compliant providers significant credibility and market access.

Need Professional Assistance?

MasiboLaw LLP advises fintechs, credit companies, asset financiers, and investors on NDTCP licensing, compliance, consumer protection, and regulatory strategy.

📞 Telephone: +254 114 529 457
📧 Email: info@masibolaw.co.ke