By Meshack Masibo & Sarah Mukeku
The Central Bank of Kenya has released the draft National Payment System Bill, 2026 which would create a new framework for licensing and supervising payment service providers (PSPs) and payment system operators (PSOs) in Kenya.
The Bill sets new licence categories and minimum core capital, mandatory trust accounts for e-money and wallet providers, interoperability and open finance obligations, and Central Bank of Kenya (CBK) approval for outsourcing.
Existing providers would have one year from commencement to comply with the whole Act.
Key takeaways
- Ten licence categories: six for PSPs and four for PSOs (First Schedule).
- Minimum core capital ranges from KES 5 million to KES 250 million. Shareholder loans and borrowed funds do not count toward it.
- Multiple licences require the highest applicable capital plus 50% of the minimum for the additional category.
- Trust accounts are mandatory for e-money issuers and e-wallet providers. Trust funds are ring-fenced from creditors and from insolvency.
- Outsourcing operational functions requires prior written CBK approval, including outsourcing within a corporate group.
- Interoperability arrangements need prior CBK approval, and the CBK can compel them.
- Fit and proper certification is required before a person takes office as a director, significant shareholder (10% or more), senior officer or trustee.
- Administrative fines reach KES 20 million per contravention for an institution, plus up to KES 100,000 per day.
- Transition: existing providers get 12 months from commencement to comply fully (s. 79).
Who does the Bill apply to?
The scope in section 4 is deliberately wide. Beyond PSPs and PSOs, it covers:
- anyone who processes, stores or shares data on behalf of a PSP or payment users;
- providers of ancillary services such as authentication, fraud prevention and data processing;
- virtual asset service providers licensed to provide payment services under the VASP Act, 2025.
Technology vendors and VASPs should therefore assess their exposure, not just licensed payment firms.
Banks, microfinance banks, building societies and listed government-owned enterprises do not need a licence. They must still obtain CBK authorisation, comply with the Act and meet the Third Schedule capital requirements (s. 9).
Licence categories
| Payment Service Providers | Payment System Operators |
|---|---|
| Payment Initiation Service Provider | Payment Gateway |
| Account Information Service Provider | Payment Messaging System Operator |
| Merchant Acquirer | Card Scheme Operator |
| Electronic Wallet Provider | Payment Switching and Clearing System Operator |
| Money Remittance Service Provider | |
| Electronic Money Issuer |
Some licensing rules worth noting:
- Who can apply: only a company limited by shares, or a foreign company holding a certificate of compliance (s. 7(1)).
- Duration: a licence runs until revoked or suspended, subject to annual fees. It cannot be transferred, assigned or encumbered (s. 8).
- Refusal: a declined applicant must wait 12 months before reapplying (s. 7(7)).
- Commencement: failing to start business within 12 months of licensing is a ground for suspension or revocation (s. 12(1)(a)).
Minimum capital requirements
| Category | Minimum core capital (KES) |
|---|---|
| Payment Initiation Service Provider | 5 million |
| Account Information Service Provider | 5 million |
| Payment Gateway | 10 million |
| Payment Messaging System Operator | 20 million |
| Money Remittance Service Provider | 30 million |
| Merchant Acquirer | 50 million |
| Electronic Wallet Provider | 50 million |
| Card Scheme Operator | 50 million |
| Payment Switching and Clearing System Operator | 50 million |
| Electronic Money Issuer | 250 million |
What counts as core capital (s. 10(4)–(5)): issued and fully paid-up ordinary share capital plus disclosed reserves, less goodwill and other intangibles. The following are excluded:
- unpaid, partly paid or contingent capital;
- shareholder loans or advances;
- capital raised through borrowing, directly or indirectly;
- revaluation reserves.
Capital must be maintained at all times, not just at licensing.
Multiple categories (s. 10(6)): a provider must hold the highest applicable minimum plus 50% of the minimum for the additional category. For example, an e-money issuer that is also a wallet provider needs KES 275 million (KES 250m plus 50% of KES 50m).
Fit and proper vetting and ownership changes
- Who must be certified: directors, significant shareholders (10% or more, including beneficial owners), senior officers (CEO, COO, CFO, CTO and others the CBK designates) and trustees. Certification must happen before they take office (s. 11).
- Shareholders found unfit: they lose voting rights immediately and must reduce their holding below 10%. The CBK may also vet smaller shareholders suspected of structuring around the threshold.
- Ownership changes: any acquisition of 10% or more, and any merger or acquisition, needs prior written CBK approval (ss. 57–58).
Safeguarding customer funds: trust accounts
E-money issuers and e-wallet providers must hold all customer funds in a trust account with a licensed bank or microfinance bank (ss. 36–40):
- Full cover: trust balances must never fall below the amount owed to customers.
- Permitted investments: only Kenya Government securities or interest-bearing trust accounts.
- Concentration limit: no more than KES 500 million or 25% of trust funds, whichever is higher, in a single bank (Fourth Schedule).
- No mixing: trust funds cannot be moved to operating accounts or commingled with other funds. They may only be used to settle customer transactions, repay customers, or for purposes the CBK gazettes.
- Protection from creditors: trust funds cannot be attached for any debt and are excluded from the provider’s insolvency estate.
- Reporting to the bank: providers must report beneficiary numbers and aggregate balances electronically to the trustee bank.
- Trust income: with CBK approval, it may go to public charitable purposes.
- Trustees: they are subject to fit and proper vetting.
Interoperability and open finance
- Interoperability (s. 28): PSPs and PSOs must use systems that are interoperable with other providers and their agents. Entering an interoperability arrangement requires prior CBK approval, and the CBK can compel one.
- Open finance (s. 29): providers must have systems capable of securely sharing customer data with third parties. Payment initiation and account information services are expressly defined as open finance services. The CBK will issue regulations on the details.
These obligations sit alongside the Data Protection Act. Consent capture, API security and data-sharing agreements will need review.
Outsourcing, agents and permitted activities
- Outsourcing (s. 30): any outsourcing of an “operational function” needs prior written CBK approval. An operational function is one whose failure would impair licence compliance, financial performance, or service soundness or continuity. The definition of outsourcing expressly includes intra-group arrangements. Cloud hosting, processing, KYC and cybersecurity contracts should be inventoried now.
- Agents (s. 31): providers remain liable for their agents’ acts and omissions.
- Activity restriction (s. 32): a licensee may not engage in any activity other than what it is licensed for. Fintechs running lending, VASP or other lines in the same entity should review their corporate structure.
Reporting, audits and disclosure
- Annual filings: the financial year ends 31 December. Audited financial statements and an annual system audit report are due within three months, both prepared by CBK-approved auditors (ss. 34–35).
- Material events: these must be reported to the CBK immediately (s. 33). They include data breaches, critical vendor failures, outages, reconciliation variances, enforcement actions, intended ownership changes and any litigation.
- Record keeping: records must be kept for seven years (s. 65).
Payment transparency and traceability
Every payment must carry the originator’s and beneficiary’s names and account numbers or unique transaction references through the full payment chain (Part X). PSPs must not execute payments with incomplete information except in circumstances the CBK prescribes. The Cabinet Secretary will set thresholds and data requirements for cross-border payments. Intermediary and beneficiary PSPs must apply risk-based procedures to reject or suspend non-compliant payments.
Enforcement and penalties
- Administrative fines:
- institutions: up to KES 20 million per contravention;
- officers: up to KES 3 million, rising to KES 5 million for repeat contraventions;
- continuing breaches: up to KES 100,000 per day (s. 71).
- Criminal penalties for bodies corporate: up to KES 20 million, or KES 30 million for a repeat offence (s. 72).
- AML/CFT breaches: up to KES 20 million for legal persons and KES 1 million for individuals (s. 19).
- CBK powers: it can remove officers, appoint directors, restrict new business, suspend or revoke licences, and appoint a statutory manager.
- Challenging decisions: apply to the CBK for review within 30 days, then appeal to the High Court within a further 30 days (s. 69).
- Regulatory sandbox: the CBK may establish one by regulation (s. 74).
What PSPs should do now
- Map current services to the new licence categories, including any multi-licence capital uplift.
- Test current capital against the core capital definition, especially any shareholder loans.
- Review safeguarding, trust deeds and bank concentration against Part VIII.
- Inventory outsourcing contracts, including intra-group ones, that may need CBK approval.
- Pre-assess directors, shareholders of 10% or more, senior officers and trustees for fit and proper certification.
- Review data-sharing, consent and API readiness for open finance and interoperability.
- Consider making submissions during public participation.
Frequently asked questions
What is the National Payment System Bill, 2026?
It is a draft law that would repeal Kenya’s National Payment System Act (Cap. 491A) and set a new framework for licensing, capital, safeguarding, conduct and supervision of payment service providers and payment system operators by the Central Bank of Kenya.
Is the Bill already law?
No. It is a draft published for public participation and may change before enactment. Its obligations apply only once it is passed and comes into force.
How long will existing PSPs have to comply?
One year from the Act’s commencement, under section 79. This covers all of the Act’s requirements, not only capital. The CBK is to issue transitional guidance.
What is the minimum capital for an e-money issuer under the Bill?
KES 250 million in core capital. Shareholder loans and borrowed funds do not qualify.
Can shareholder loans count toward minimum capital?
No. Core capital is limited to fully paid-up ordinary share capital and disclosed reserves, less intangibles. Shareholder loans, borrowed funds, partly paid capital and revaluation reserves are excluded.
What is the difference between a PSP and a PSO?
A payment service provider offers payment services to users, such as e-wallets, e-money, remittance, merchant acquiring, payment initiation or account information. A payment system operator runs the underlying infrastructure: payment gateways, messaging systems, card schemes, or switching and clearing systems.
Do banks need a PSP licence under the Bill?
No. Banks, microfinance banks, building societies and listed government-owned enterprises need CBK authorisation instead, and must meet the Third Schedule capital requirements.
Does outsourcing to a group company need CBK approval?
Yes, if it covers an operational function. The Bill’s definition of outsourcing expressly includes affiliated companies within a group.
Are customer funds protected if a PSP becomes insolvent?
Yes. Trust account funds held by e-money issuers and wallet providers cannot be attached for debts or used to settle the provider’s insolvency liabilities.
Does the Bill apply to virtual asset service providers?
Yes, to VASPs licensed to provide payment services under the Virtual Asset Service Providers Act, 2025. The Bill also reaches technology vendors that process, store or share data on behalf of PSPs.
Can a licensed PSP run other businesses, such as lending, in the same company?
Section 32 prohibits a PSP or PSO from engaging in any activity other than what it is licensed for. Businesses running multiple lines in one entity may need to restructure, for example into separate subsidiaries.
MasiboLaw LLP advises fintechs, PSPs and investors on CBK licensing, payments regulation, data protection and corporate structuring. To assess how the Bill affects your business or to prepare public participation submissions, contact us at info@masibolaw.co.ke.
This article is for general information only and is not legal advice. It is based on the draft National Payment System Bill, 2026 as published for public participation, which may change during the legislative process.
Leave a Reply