Digital Lending Apps and Predatory Lending Enforcement: Compliance for Fintech Startups

Kenya’s digital lending sector has a licensing regime, which we cover separately in our guide to Digital Credit Provider Licensing in Kenya, and it has a separate, increasingly active enforcement layer targeting how licensed and unlicensed lenders actually treat borrowers. For a fintech startup, the conduct rules matter as much as the licence itself: getting licensed does not immunise a lender against enforcement for debt-shaming, data misuse, or predatory collection tactics, and regulators have shown they will act on exactly those grounds.

What counts as prohibited conduct, specifically

Regulation 20 of the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 prohibits a digital credit provider, and its officers, employees, or agents, from using threats or violence in debt collection; using obscene or profane language toward a customer or the customer’s contacts for shaming purposes; accessing a customer’s phone book or contact list to send messages about non-payment; posting a customer’s personal or sensitive information online for shaming; or making unauthorised calls or messages to a customer’s contacts. This is the specific legal basis for the contact-harvesting and debt-shaming practices that made a wave of Kenyan lending apps notorious, and it is a distinct compliance obligation from the licensing mechanics themselves. Regulation 13 separately requires providers to keep customer information confidential and prohibits sharing it with third parties without consent, except where required or permitted by law. Regulation 19 caps what a provider can recover on a defaulted loan at the principal plus interest not exceeding the principal, plus reasonable recovery expenses, a direct constraint on runaway penalty pricing rather than a licensing formality.

Disclosure and complaints obligations

Regulation 27 requires clear disclosure, in simple and accessible language, of the loan amount, all charges and when they apply, the interest rate and whether it is calculated on a reducing balance, the total cost of credit, the annual percentage rate, and the complaints procedure. Regulation 22 requires complaints to be resolved promptly, within thirty days if not immediately. Regulation 14 restricts negative credit reference bureau listings for amounts of KES 1,000 or less and requires seven to thirty days’ advance notice before a negative listing is made. Breach of the conduct regulations carries penalties of up to KES 500,000 plus KES 10,000 for each day a violation continues, alongside possible suspension, revocation, or director disqualification under Regulation 37.

Where enforcement has actually happened, and where it hasn’t

It is worth being precise here, because the public record does not support every enforcement claim circulating about this sector. The Central Bank issued a blanket cease-and-desist notice in September 2022 to all digital credit providers that had not obtained a licence, but that notice did not name specific companies, and we were not able to find a CBK public notice revoking any specific, previously-licensed provider’s licence for conduct-based reasons such as debt-shaming or contact harvesting. Reported CBK licence revocations we could verify concerned unrelated categories, money remittance and payment service provision, not digital credit conduct. Separately, the Office of the Data Protection Commissioner asked CBK in August 2025 to revoke two lenders’ licences over persistent phonebook-harvesting complaints, but the two lenders were not named in that reporting and it is not confirmed whether CBK acted on the request. Where enforcement has been concrete and verifiable is at the Office of the Data Protection Commissioner itself: it fined Whitepath Company Limited and Regus Kenya KES 5,000,000 each in April 2023 over roughly 150 complaints of unauthorised contact-list access and threatening messages, and fined Mulla Pride Limited, operator of the KeCredit and Faircash apps, KES 2,975,000 in September 2023 for obtaining and misusing complainants’ contact details. Mulla Pride’s later constitutional challenge to that fine was dismissed in August 2025, with the court holding it should have used the statutory appeal route under section 64 of the Data Protection Act rather than a constitutional petition, a useful precedent for the proposition that these fines hold up when tested.

The courts have also started shutting the door on unlicensed lenders

Beyond regulatory enforcement, Kenyan courts have begun refusing to let unlicensed lenders use the legal system to recover debts at all. The Milimani Small Claims Court dismissed 139 debt-recovery cases brought by non-deposit-taking credit providers operating without the required licence, relying on section 33S of the Central Bank of Kenya Act, which now governs licensing for what the law calls non-deposit taking credit business following its 2024 amendment. The practical message for a startup considering informal or unlicensed lending activity, even briefly, is that the licensing requirement is not merely a compliance box to tick; it is also a precondition to being able to enforce your own loan book in court.

What’s coming: broader conduct rules already in draft

A draft Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2025, published for comment in August 2025, would carry forward and broaden the existing phonebook-access and harassment prohibitions, adding a catch-all covering any other conduct that harasses or oppresses a customer, and would introduce a new mandatory opt-out mechanism for marketing communications alongside a ban on using customer data for marketing once a customer opts out. A separate draft CBK Financial Consumer Protection Framework, circulated for comment in April 2026, takes aim more broadly at predatory lending, hidden fees, forced product bundling, and data misuse across the consumer credit sector generally, not digital lending alone. Neither has been finalised or gazetted as of this writing, and a startup building compliance processes now should treat both as a strong signal of where enforcement priorities are heading, not as rules currently in force.