Anyone offering digital lending in Kenya needs to be licensed by the Central Bank of Kenya (CBK). This area is in the middle of a significant regulatory transition, and getting the current state right matters, since a lot of commentary online describes rules that are not yet in force. This article sets out the regime that actually applies today, and flags what is coming next.
The Current Operative Law
Digital lending in Kenya is currently licensed under the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 (Legal Notice No. 46 of 2022), made under section 57 of the Central Bank of Kenya Act. A person may not establish or carry out digital credit business, or hold themselves out as doing so, without a CBK licence, unless already regulated under another written law such as the Banking Act, the Microfinance Act, or the Sacco Societies Act.
No Minimum Capital Requirement
This surprises people who assume a CBK-regulated lender must meet a capital floor the way a bank or microfinance institution does. The 2022 Regulations impose no minimum capital requirement on a digital credit provider. What they do require is a description and evidence of the sources of funds to be invested in the applicant, and a sworn declaration that the capital is not proceeds of crime. Some commentary circulating online cites a KES 100 million capital requirement for digital lenders; that figure does not appear anywhere in the current Regulations and should not be relied on.
Documentation Requirements
An application on Form CBK DCP 1 must be accompanied by a substantial package: certified certificate of incorporation and memorandum and articles of association, registered address notification, a description of the ICT system to be used together with independent assurance on it, a description of delivery channels and platforms, a description of the credit products and services intended, any agreement with a telecommunications or platform provider, AML/CFT policies, data protection policies, consumer redress policies, evidence of sources of funds, the applicant’s credit policy, code of ethics and market conduct, pricing model, corporate governance policy, and fit and proper documentation for directors, the chief executive, senior officers, and significant shareholders (Form CBK DCP 2 and Form CBK DCP 3). Significant shareholders are defined as anyone holding, directly or indirectly, ten per cent or more of the share capital.
Fees
The Second Schedule to the 2022 Regulations sets the application fee at Kshs. 5,000, and the fee payable on grant of licence and annually thereafter at Kshs. 20,000, due by 31 December each year.
What a Licensed Provider Cannot Do
A digital credit provider may not invite or collect deposits in any form, including taking cash collateral as security for loans. Recovery on a non-performing loan is capped at the principal owing when it became non-performing, plus contractual interest not exceeding that principal amount, plus reasonable recovery expenses, a limit modelled on the in duplum principle applied to banks. Debt collection conduct is tightly restricted: no threats or violence, no use of obscene or profane language to shame a customer, no accessing a customer’s contacts to send shaming messages, no posting personal information online, and no unauthorised contact with a customer’s phone contacts.
Suspension and Revocation
The CBK may suspend or revoke a licence where the provider does not meet or has contravened licensing conditions, fails to pay annual fees or an imposed penalty, gave false information in its application, ceases to carry on business, goes into liquidation or is wound up, violates AML/CFT laws, contravenes the Act or regulations relating to digital lending, or conducts business in a manner detrimental to customers or the public interest. The Bank must give the licensee written notice and an opportunity to be heard before acting, and must publish the names of providers whose licences are suspended or revoked in the Gazette within thirty days. Administrative sanctions available to the CBK include monetary penalties of up to Kshs. 500,000, continuing penalties of up to Kshs. 10,000 per day of ongoing violation, suspension of a non-compliant director or officer from office, disqualification from holding any position at a licensed financial institution in Kenya, more frequent inspections, and suspension or revocation of the licence itself.
The Regulatory Transition Under Way
On 27 December 2024, the Business Laws (Amendment) Act, 2024 amended section 33S of the Central Bank of Kenya Act, replacing the term “digital credit business” with “non-deposit-taking credit business.” This was a deliberate widening of CBK’s regulatory reach: the amendment brings credit providers who lend through non-digital channels, previously outside CBK’s oversight, within the same regime as digital lenders. “Non-deposit-taking credit provider” (NDTCP) is now the correct statutory term, even though the operative regulations at the time of writing are still the 2022 DCP Regulations and still use “digital credit provider” throughout.
The CBK published draft Central Bank of Kenya (Non-Deposit-Taking Credit Providers) Regulations, 2025 for public comment in August 2025, intended to implement the 2024 amendment and eventually repeal the 2022 DCP Regulations entirely. As of the most recent information available, these remain in draft and have not been gazetted. Once in force, they would introduce a materially different structure: a two-tier system where entities with initial capital, borrowings, or loan book exceeding KES 20 million must be licensed, while those below that threshold may instead register, with lighter documentation requirements. The draft also proposes a steep fee increase, an application fee of Kshs. 100,000 for both licensing and registration, and annual fees of Kshs. 500,000 for licensed entities and Kshs. 250,000 for registered ones, against the current Kshs. 5,000 and Kshs. 20,000. Proposed monetary penalties also rise substantially, up to Kshs. 2,000,000 or three times the gain or loss avoided, whichever is higher.
Given how much is set to change, and that the draft Regulations are still broadly worded enough to raise real questions about their reach to foreign lenders and development finance institutions, anyone approaching a digital or non-digital credit licensing question in Kenya right now should confirm the current gazettal status directly with the CBK before relying on either the 2022 figures or the draft 2025 figures as final.
How This Fits the Wider Regulatory Landscape
Digital credit sits within the broader financial services regulatory environment alongside CMA-licensed forex brokers and money managers, though CBK and CMA are separate regulators with separate regimes. For a wider view of that environment, see our financial services industry practice. For related compliance work, see our guide on AML reporting obligations to the Financial Reporting Centre, which applies to digital credit providers as much as other regulated financial businesses.
How We Can Help
Clay & Associates Advocates advises digital and non-deposit-taking credit providers on CBK licensing applications under the current 2022 Regulations, and on preparing for the transition to the NDTCP regime once it is finalised. Given the pace of change in this area, we track the draft Regulations’ progress toward gazettal directly rather than relying on commentary that may already be outdated. Contact our regulatory and compliance team to discuss a licensing application or a readiness review for the coming changes.
Sources: Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 (Legal Notice No. 46 of 2022); Central Bank of Kenya Act, section 33S as amended by the Business Laws (Amendment) Act, 2024; draft Central Bank of Kenya (Non-Deposit-Taking Credit Providers) Regulations, 2025.
