Digital Credit Provider Licensing in Kenya: CBK Requirements and the NDTCP Transition

Digital credit provider licensing in Kenya has just changed. The Central Bank of Kenya (CBK) now regulates lenders under the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026 (Legal Notice 191 of 2026), which were published and commenced on 29 September 2026 and revoke the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022. A lot of online commentary still describes the 2022 rules or the 2025 draft, so this article sets out the regime that applies today.

What Changed and Why

The Business Laws (Amendment) Act, 2024 changed the Central Bank of Kenya Act so that the licensing provision in section 33S now refers to non-deposit taking credit business, not only digital credit business. That widened CBK’s reach to lenders who lend through non-digital channels. “Non-deposit taking credit provider” (NDTCP) is now the statutory term, and the 2026 Regulations implement it. Anyone who still treats the 2022 Regulations as current should stop: Regulation 97 of the 2026 Regulations revokes them.

Licence or Registration: the KES 20 Million Test

A person may not establish or hold themselves out as carrying on non-deposit taking credit business unless licensed or registered by CBK, or unless the business is regulated under another written law. The Regulations create two tiers:

• Licence. A person whose initial capital is not less than twenty million shillings applies for a licence in Form 1 (regulation 6). A registered provider whose capital, borrowings or loan book exceeds twenty million shillings must apply to convert its registration into a licence (regulation 11).
• Registration. A person that does not meet the licensing conditions applies for registration under Part III (regulation 9), with lighter requirements.

CBK may also direct a registered provider to apply for a licence in the circumstances the Regulations set out.

Documentation and Fit and Proper Requirements

A licence application must be accompanied by a substantial package, including certified incorporation documents, the memorandum and articles, details of shareholders, evidence of the source of funds with a declaration that the funds are not proceeds of crime, and fit and proper forms for directors, the chief executive and senior officers, and for significant shareholders. Under regulation 14, no one may act as a significant shareholder, director, chief executive officer or senior officer unless CBK has certified them as fit and proper, although a conditional appointment of a chief executive or senior officer is allowed pending certification. Providers must also keep at least one registered physical office in Kenya.

Before any application, the promoters need CBK approval of the company name under regulation 4. They submit three proposed names with a Business Registration Service name reservation, shareholder identification and a high-level business brief. Once CBK approves a name, the promoters obtain a letter of no objection from the Kenya Industrial Property Institute (regulation 4(3)), and the company must be incorporated within three months and must apply for a licence or registration within six months of incorporation. A licence application under regulation 6(2) must also include a certificate of registration issued under section 19 of the Data Protection Act, and certificates of good conduct, tax compliance certificates and credit reference bureau reports for each individual significant shareholder, director, chief executive officer and senior officer. Regulation 7(2) contemplates CBK granting a licence within sixty days of submission of the application.

Fees

The Third Schedule sets an application fee of Kshs. 100,000 for a licence or registration, an annual licence fee of Kshs. 500,000 and an annual registration fee of Kshs. 250,000. Annual fees are due by 31 December. A provider that pays late faces double fees if it pays within three months, and the Schedule also lists a late penalty fee of Kshs. 1,000,000. Compare these with the Kshs. 5,000 application fee and Kshs. 20,000 annual fee under the revoked 2022 Regulations, which is a steep increase.

Transition for Existing Lenders

Regulation 96 sets the transitional rules:

• A person already conducting non-deposit taking credit business that is not regulated under another written law must apply for a licence or registration within six months of publication of the Regulations, and may continue operating while the application is pending, subject to CBK’s conditions.
• A provider licensed under the 2022 Regulations is not affected by the registration requirements, continues to operate, and is deemed licensed under the new Regulations.
• Licence applications pending at commencement are processed under Part II or Part III, as applicable.

Because the six-month window runs from 29 September 2026, lenders that were previously outside CBK’s reach should treat the application deadline as a live compliance item.

Conduct Rules and Debt Collection

The Regulations restrict how providers collect debts. A provider may not threaten or shame a customer, use abusive language directed at a customer or the customer’s contacts, access a customer’s phone book or contact list to send messages about unpaid loans, or post a customer’s personal or sensitive information online. Consumer protection, anti-money laundering, reporting and a code of conduct are covered in later Parts of the Regulations, and providers should map their policies against each of them.

Suspension and Revocation

CBK may suspend or revoke a licence or registration on listed grounds, including failure to comply with administrative action under the Data Protection Act, failure to pay annual fees or a monetary penalty, failure to follow a CBK directive or administrative sanction, giving false information in an application, illegal activity, ceasing business, or liquidation. CBK must first tell the provider in writing why it intends to act and give it an opportunity to respond.

How This Fits the Wider Regulatory Landscape

CBK and the Capital Markets Authority are separate regulators with separate regimes. For related compliance work, see our guide to AML reporting to the Financial Reporting Centre, our guide to CBK forex bureau licensing, and our note on the regulatory sandbox for fintech in Kenya.

Frequently asked questions

This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.