Regulatory AlertsKenya: lending & credit regulation
RegulatedCBK licenses digital credit providers; Microfinance Act covers traditional lending
- Lead regulator
- Central Bank of Kenya (CBK)
- Also involved
- ODPC (Data Protection) · NCA (Insurance/Reinsurance)
- Core law
- Digital Credit Providers Regulations, 2022
- Entry capital
- KES 100m (Digital Credit Provider)
- Approval timeline
- 6-12 months for DCP license
- Customer assets
- Segregated accounts required
- Data protection
- Data Protection Act 2019 · ODPC
- Sandbox
- Yes - CBK Regulatory Sandbox
Kenya regulates digital consumer lending under the CBK's 2022 Digital Credit Providers Regulations, requiring a specific license and KES 100m capital. Traditional SME and microfinance lending are governed by the Microfinance Act and Banking Act, supervised by the CBK. The regulatory environment is strict, with active enforcement against unlicensed entities and a focus on consumer protection and credit information sharing.
Which licence do you need?
| Your activity | Requirement | Capital | Timeline | Authority |
|---|---|---|---|---|
| Consumer lending | LicenceDigital Credit Provider License[1] Applies to digital/mobile lending; strict consumer protection rules | KES 100m | 6-12 months | Central Bank of Kenya |
| SME / commercial lending | LicenceMicrofinance Bank License[2] Requires Microfinance Bank license under Microfinance Act | — | — | Central Bank of Kenya |
| Microfinance | LicenceMicrofinance Bank License[2] Regulated under Microfinance Act 2006 | — | — | Central Bank of Kenya |
| Buy-now-pay-later | LicenceDigital Credit Provider License[1] If structured as credit, falls under DCP regulations | KES 100m | — | Central Bank of Kenya |
| P2P lending platform | Uncertainverify with regulator No specific P2P lending license defined in provided docs | — | — | — |
| Credit bureau / scoring | LicenceCredit Reference Bureau License[3] CRBs must be licensed under Banking (CRB) Regulations | — | — | Central Bank of Kenya |
| Debt collection | Uncertainverify with regulator General debt collection not explicitly licensed in docs | — | — | — |
New — what changed recently
- 2023-10-18ML-TF-PF Sectoral Risk Assessment — CBK classified digital credit providers in a sectoral risk assessment, highlighting ML/TF vulnerabilities.[4]
- 2022-11-14Credit Repair Framework — CBK approved a framework for digital loan borrowers to repair credit standing via repayment plans.[5]
- 2022-03-21Digital Credit Providers Regulations 2022 — Formalized licensing, capital, and consumer protection requirements for digital credit providers.[1]
Market-entry checklist
- 1Secure DCP License from CBKSubmit application with KES 100m capital proof and fit/proper criteria for directors.
- 2Register with ODPCComply with Data Protection Act 2019 for processing borrower personal data.
- 3Integrate with CRBsConnect to licensed Credit Reference Bureaus for full-file credit information sharing.
- 4Implement Consumer ProtectionAdhere to CBK guidelines on transparent pricing, disclosure, and fair treatment.
- 5Establish AML/CFT FrameworkImplement robust anti-money laundering and counter-terrorist financing controls.
Sources
- Central Bank of Kenya (Digital Credit Providers) Regulations 2022 · 2022-03-21
- Banking Circular No. 8 of 2023 - Compliance with Banking Act and Central Bank of Kenya Prudential Guidelines · 2023-09-14
- Credit Reference Bureau Regulations, 2020 · 2020-04-17
- Central Bank of Kenya Circular No. 11 of 2023 - Dissemination of ML-TF-PF Sectoral Risk Assessment Report · 2023-10-18
- Banking Circular No. 4 of 2022 - Credit Repair Framework · 2022-11-14