Acquiring a Licensed Financial Services Business in Kenya: Change-of-Control Approvals and Regulatory Due Diligence

Buying a stake in a Kenyan bank, insurer or licensed fintech is never just a share purchase agreement. Every regulated financial services business in Kenya carries its own change-of-control approval requirement, layered on top of, and separate from, the ordinary company law mechanics of transferring shares. Get the regulatory sequencing wrong and a deal that looked commercially closed on signing can sit unable to complete for months.

Banks: a 5% trigger, not just a controlling-stake trigger

Under section 13(4) of the Banking Act, no institution may transfer more than 5% of its share capital to an individual or entity without the Central Bank of Kenya’s prior written approval. That threshold catches far more transactions than most acquirers expect: it is not limited to a change of control in the ordinary sense, so even a significant minority investment can require CBK sign-off. Section 9A adds a further layer, requiring CBK to certify any person becoming a “significant shareholder,” defined at 5% or more, as fit and proper before the shareholding proceeds. The scale this can reach is illustrated by Nedbank Group’s acquisition of up to 66% of NCBA Group, approved by CBK at the end of August 2026 in a deal reported at roughly KES 116 billion, one of the largest banking transactions CBK has cleared under this framework. Where an acquisition also involves transferring specific assets and liabilities between entities, as in Access Bank’s 2025 acquisition of National Bank of Kenya from KCB Group, a separate approval under section 9 of the Act and National Treasury sign-off can also apply alongside the section 13(4) shareholding approval.

Insurers: approval is tied to preserving the local ownership floor

The Insurance Act does not contain a freestanding “any change of control needs approval” clause in the way the Banking Act does. Instead, section 25(4) ties the Insurance Regulatory Authority’s approval requirement to protecting the local-ownership floor set by sections 22 and 23: an insurer cannot register a share transfer if doing so would reduce East African Community citizen shareholding below the required one-third of controlling interest, without the Commissioner’s prior written approval. In practice this means the acquirer’s own shareholding percentage is only half the analysis; the deal team also has to model what the transfer does to the remaining shareholder register’s EAC-citizen composition. An acquisition that leaves the target technically compliant on the buyer’s stake but non-compliant on the register as a whole will not clear.

Capital markets intermediaries and non-bank lenders: no-objection first, every time

For CMA-licensed intermediaries, Regulation 53B of the Capital Markets (Licensing Requirements) (General) Regulations requires the CMA’s prior written no-objection before any change of shareholders, directors, chief executive or key personnel, with no minimum percentage threshold, and Regulation 54A requires notification of any capital-structure change within five working days. For Digital Credit Providers regulated under the CBK (Digital Credit Providers) Regulations, 2022, a comparable approval architecture applies to the licence itself and to shareholding changes, consistent with the sector-specific licensing regime we cover in our guide to Digital Credit Provider licensing in Kenya. The common thread across every one of these regimes, banking, insurance, capital markets and digital credit, is that the regulator’s approval is a condition precedent to completion, not a formality to notify after signing.

The competition law layer most acquirers underweight

A financial services acquisition that clears its sectoral regulator is not necessarily finished. Kenyan merger transactions above prescribed turnover and asset thresholds also require Competition Authority of Kenya clearance under the Competition Act, running in parallel with, not instead of, CBK, IRA or CMA approval. We were not able to independently confirm the current numeric CAK thresholds from a primary source during this research, since secondary sources gave inconsistent figures, so any specific threshold should be confirmed directly against CAK’s current Consolidated Merger Guidelines before a deal team relies on it to decide whether notification is required. What is well established as a matter of standard practice is that a deal team assessing a Kenyan financial services acquisition should run the CAK merger-notification analysis alongside the sectoral regulatory approval from the outset, rather than treating it as an afterthought once the sectoral approval is secured.

Sequencing due diligence around the approval, not around signing

Because every one of these approvals is a condition to completion rather than a formality, regulatory due diligence has to start before the transaction is signed, not after. That means confirming the target’s own licence is in good standing, identifying which specific approval threshold the proposed structure will trigger, and building the regulator’s own timeline into the transaction schedule rather than assuming a fixed number of days, since none of the underlying statutes we reviewed prescribes a specific statutory decision timeline for CBK, IRA or CMA change-of-control approval. A share purchase agreement conditioned on “customary regulatory approvals” without naming the specific section and regulator involved is a common and avoidable source of later dispute over what closing actually requires.