MasiboLaw LLP

By Meshack Masibo & Sarah Mukeku

The Central Bank of Kenya (CBK) has introduced significant changes to the regulation of digital credit providers through the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026, gazetted on 29 September 2026. The Regulations repeal the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022, introducing a broader regulatory framework that extends beyond digital lenders and reflects the evolving credit market.

From Digital Credit Providers to Non-Deposit-Taking Credit Providers

The 2022 Regulations established a licensing framework specifically for Digital Credit Providers (DCPs), bringing previously unregulated digital lenders under CBK supervision.

The 2026 Regulations expand this approach by introducing the concept of Non-Deposit-Taking Credit Providers (NDTCPs). This category covers businesses that lend using their own funds without accepting customer deposits, such as mobile lenders, asset financiers, and providers of buy now pay later, stock now pay later, pay as you go and peer-to-peer lending.

The Regulations do not apply to banks, microfinance institutions, SACCOs, co-operative societies, hire-purchase and lease finance arrangements, or credit that is merely incidental to the sale of goods or services.

Significant Increase in Licensing Fees

One of the most notable reforms is the substantial increase in licensing costs as provided in the Third Schedule of the Regulations.

Fee Type	Previous 2022 DCP Regulations, 2026	Current 2026 NDTCP Regulations (KES)
Application Fee	5,000	100,000 (for a licence or registration.)
Annual Licence Fee	20,000	500,000
Annual Registration Fee	Not applicable	250,000
Late Payment Penalty Fee	Not applicable	1,000,000

Annual fees are payable on the grant of the licence or registration and annually thereafter, on or before 31 December. Late payment attracts additional penalties, and continued non-payment may lead to revocation.

Licence or Registration: A Two-Tier Framework

The Regulations provide two regulatory pathways, based on the size of the business.

• Licence: Applicants with initial capital of KES 20 million or more must apply for a licence.
• Registration: Entities with initial capital below KES 20 million apply for registration instead, which carries a lighter regime and a lower annual fee.
• Moving up: A registered provider must apply for a licence once its capital, borrowings or loan book exceeds KES 20 million.

This distinction promotes proportionate regulation by recognising differences in the scale and financial capacity of credit providers, while maintaining appropriate regulatory oversight.

Transition

Unlicensed lenders must apply for a licence or registration within six months of publication of the Regulations. They may continue operating while their application is pending, subject to the Regulations and any conditions imposed by the CBK(Regulation 96).

Providers licensed under the 2022 Regulations are deemed licensed under the new framework, and rights and liabilities accrued under the 2022 Regulations are preserved. These providers remain subject to every new operational, pricing, consumer protection and reporting requirement(Regulation 96).

New Obligations for Credit Providers

Beyond licensing, the Regulations introduce detailed operating requirements.

Products and pricing

• A provider may not introduce a new product, or vary the features of an existing product (including interest rates), without the CBK’s prior written approval, and must justify the proposed variation. Customers must be notified at least thirty days before a variation takes effect (regulation 26).
• Changes to pricing parameters and credit terms also require the CBK’s prior written approval, thirty days’ notice to the customer and the customer’s acceptance (regulation 55).
• A provider must maintain a pricing model that identifies the components of pricing, applies all-inclusive pricing (excluding third-party costs), takes account of customer risk and credit reference bureau information, and discloses the annual percentage rate (regulation 59).
• Advertisements and promotional materials must show the annual percentage rate and the total cost of credit (regulations 51 and 52), and loan agreements must state them (regulation 54).
• A borrower may repay a loan early, in whole or in part, without advance notice or penalty, and on full early repayment owes no interest for the remaining period to maturity (regulation 56).

Recovery and collections

• On a non-performing loan, a provider may recover only the principal owing when the loan became non-performing, interest not exceeding that principal, and reasonable recovery expenses. However, interest accruing under a court order after it is made is not limited (regulation 29).
• A loan becomes non-performing where principal or interest remains outstanding after thirty days (for loans of thirty days or less) or ninety days (for longer loans), or after such period as the loan agreement specifies (regulation 57).
• Providers, their staff and their outsourced collectors may not access a borrower’s phone contacts to send messages over non-payment, shame a borrower publicly or online, use abusive language, make calls outside working hours, or harass a borrower or use violence in collecting or repossessing security (regulation 30).
• Charges not disclosed in the signed contract cannot be recovered, and the CBK may direct a refund (regulation 30).
• A person is liable as a guarantor only where their consent was obtained. A provider may seek recourse against a guarantor only after non-judicial recovery against the borrower has been exhausted, and may not demand payment unless the guarantor has been given fourteen days’ notice of the borrower’s default (regulation 42).
• A provider may not submit negative credit information to a credit reference bureau where the amount outstanding does not exceed KES 1,000. Otherwise, it must give the customer at least thirty days’ notice (seven days for loans repayable at intervals of less than thirty days, or a shorter contractual period not below that minimum), and notify the customer within thirty days after the information is submitted (regulation 33).

Prohibited activities

• Deposit-taking, savings products (including lock savings, investment or goal accounts) and taking cash as security for loans
• Collecting registration fees, membership fees and other fees determined by the CBK from loan applicants or borrowers
• Money pools, credit reference bureau business and trust operations
• Foreign exchange business and disbursing loans in foreign currencies
• Payment services and transfer of funds

These prohibitions are in regulation 18.

Data, technology and outsourcing

• Consent to process a customer’s personal data must be express, freely given, specific, unambiguous, withdrawable and verifiable. It must be obtained through a separate consent form, and a privacy notice alone is not sufficient (regulation 58).
• Where artificial intelligence is used in lending decisions, the provider must explain automated decisions that affect a loan application, inform customers when they are interacting with an artificial intelligence system, retain human oversight, and assess and mitigate discriminatory bias (regulation 60).
• A provider must notify the CBK within twenty-four hours of any fraud or cybersecurity incident that may have a significant impact on its ability to provide adequate services, its reputation or its status, using Form 5 (regulation 66).
• A provider may outsource material services but remains liable for the acts and omissions of the third-party service provider. It may not outsource the final decision to grant loans, management and control, board decision-making, compliance determinations or management of the loan portfolio, and must notify the CBK at least thirty days before entering a material outsourcing arrangement (regulation 31).

Ownership and governance

• Significant shareholders (holding ten percent or more), directors, the chief executive officer and senior officers of licensed providers must be certified by the CBK as fit and proper (regulation 14).
• A provider must notify the CBK at least thirty days before changes in significant shareholding, board or management structure, or the appointment of a new director, chief executive officer or senior officer, and within seven days of a resignation or removal (regulation 15).
• A transfer of ten percent or more of a provider’s shareholding or beneficial interest requires the CBK’s prior approval, and a transfer of fifty percent or more is not permitted within the first twelve months of operation (regulation 22).
• Amalgamations and transfers of the credit business require the CBK’s prior approval, and an acquisition of or merger with another provider also requires the Competition Authority’s letter of no objection or authorisation (regulation 22).

Complaints and reporting

• A provider must resolve a customer complaint immediately or, where that is not possible, within thirty days. Where a complaint cannot be dealt with promptly, it must be acknowledged within seven days, and an oral complaint not resolved within forty-eight hours must be confirmed in writing (regulation 40).
• A provider must submit to CBK monthly returns (including on complaints, customer data, loan repayments and loan accounts) within ten days after the end of the reporting period, together with quarterly returns on matters such as borrowings, non-performing loans, capital and outsourced services (regulation 66).
• A provider must submit to CBK audited financial statements within three months after the end of each financial year (regulation 67) and, on or before 31 December each year, a return certifying its compliance with the Regulations (regulation 66).

Enhanced Compliance and Enforcement

The Regulations significantly strengthen the CBK’s enforcement powers. Institutions that fail to comply may face a range of administrative sanctions, including:

• Monetary penalties not exceeding KES 2 million, or three times the gross amount of the gain made or loss avoided, whichever is higher, together with additional penalties of up to KES 10,000 for each day a failure continues
• Monetary penalties of up to KES 250,000 on a senior officer responsible for a violation, payable from the officer’s own resources
• Disqualification of a significant shareholder, director or senior officer from holding office in any non-deposit taking credit provider for three years
• Increased regulatory inspections
• Prohibitions on granting new loans, using specified delivery channels or carrying on certain activities
• Suspension or revocation of a licence or registration

Monetary penalties apply to each violation. Before suspending or revoking a licence or registration, the CBK must give the provider written reasons and an opportunity to be heard.

A provider aggrieved by a CBK decision may request a review within 14 days on limited grounds. A review request does not suspend the decision, and any request to suspend an administrative sanction must be made before its commencement date.

These measures demonstrate the CBK’s continued focus on ensuring compliance, promoting market integrity, and protecting consumers.

Practical Implications for Credit Providers

The Regulations are likely to have significant commercial and operational implications across the industry:

• For Existing Credit Providers: Higher annual fees, together with the new pricing, collections, data and reporting requirements, will increase compliance costs that should be factored into financial planning and budgeting. Providers deemed licensed under the 2022 Regulations must still bring their operations into line with the new framework.
• For New Entrants: The higher application fee and the extensive supporting documents, including board-approved policies and fit and proper information on directors and shareholders, will increase the cost and time needed to enter the market.
• For Smaller Institutions: Registration may provide a more accessible pathway, but providers should monitor their capital, borrowings and loan book to anticipate when a licence becomes mandatory.
• For Unlicensed Lenders: The six-month application period is running, and businesses operating outside the framework should act promptly.

Ultimately, businesses will need to assess their capital structure, operating model, collections practices and ownership arrangements to determine the most appropriate regulatory category under the framework.

Conclusion

The Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026 reflect the CBK’s continued efforts to strengthen oversight of Kenya’s credit sector while promoting greater accountability and consumer protection. As the framework introduces new licensing requirements, higher compliance costs, and enhanced regulatory obligations, businesses should take proactive steps to understand and prepare for the changes.

At MasiboLaw LLP we remain committed to helping businesses navigate the evolving regulatory landscape by providing practical legal advice on licensing, regulatory compliance, and risk management.

In case you need any assistance you can reach us on info@masibolaw.co.ke