FinTech Regulation in Kenya: What Every Payment Service Provider Needs to Know

FinTech regulation in Kenya is layered. The National Payment System Act, 2011 (NPSA) governs payment service providers, the Central Bank of Kenya Act governs non-deposit-taking credit providers, the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) imposes anti-money laundering duties, and the Data Protection Act, 2019 governs the personal data a FinTech business handles. A business that does payments, lending and data processing must comply with each framework separately; one Central Bank of Kenya (CBK) licence does not cover the whole stack.

FinTech Regulation in Kenya: NPSA Authorisation

Section 12(1) of the NPSA provides that no person shall, in Kenya, conduct the business of a payment service provider except as an authorised payment service provider. Contravention is an offence carrying a fine of up to five hundred thousand shillings, imprisonment of up to three years, or both (section 12(2)). Under section 13, a person proposing to conduct that business must apply to the CBK before starting, in the prescribed form and with the prescribed fee.

In considering an application, section 13(3) allows the CBK to require to be satisfied as to the applicant’s financial condition and history, the character of its management, the adequacy of its capital structure, the convenience and needs of the area to be served and the public interest. The CBK may grant authorisation subject to fees and conditions (section 13(4)) and may later add, vary or substitute conditions (section 13(5)). Authorisation can be renewed or revoked under sections 14 and 15. Detailed requirements are in the National Payment System Regulations, 2014, and our article on payment service provider licensing in Kenya covers the process.

Digital Lending

Part VIC of the Central Bank of Kenya Act deals with non-deposit-taking credit providers and was inserted by Act No. 15 of 2021 and amended by Act No. 20 of 2024. Section 33R(1) empowers the CBK to register, license and regulate non-deposit-taking credit providers not regulated under another written law, approve the channels through which the business may be conducted, determine parameters for pricing of credit, supervise those providers, and prescribe an enforceable Code of Conduct binding them.

Section 33S(1) provides that a person shall not carry on non-deposit-taking credit business unless licensed by the CBK under the Act or permitted to do so under another written law. The definition of non-deposit-taking credit business in section 2 covers granting loans or credit facilities, whether or not digitally, to members of the public. Because the 2021 framework has been amended since, a lender should check the current text and the regulations made under it. Our guide to digital credit provider licensing covers the licensing steps.

The Regulatory Sandbox

Innovators may be able to test new products under CBK oversight through a regulatory sandbox, but sandbox participation is not a licence and does not remove the legal requirements that apply when the product operates commercially. We have not summarised the sandbox terms here because they depend on the CBK’s current published guidance; read our article on the regulatory sandbox in Kenya and plan the move to full licensing before the testing period ends.

AML and KYC Under POCAMLA

POCAMLA defines a reporting institution to include a financial institution, and the definition of financial institution includes a business that lends, transfers funds or value, or issues and manages means of payment such as electronic money. Payment providers and lenders are therefore likely to be reporting institutions whatever licence they hold. Section 44 deals with monitoring and reporting by institutions, section 45 with the obligation to verify customer identity, and section 46 with record keeping. A compliance programme built only around licensing conditions is incomplete, and a CBK licence in good standing does not discharge POCAMLA obligations. Our article on reporting to the Financial Reporting Centre explains the reporting process.

Data Protection in Credit Scoring and Payments

A product that processes personal data for credit scoring, fraud detection or transaction monitoring must also comply with the Data Protection Act. Section 30(1) allows processing only with the data subject’s consent or where it is necessary for a listed purpose such as performing a contract, complying with a legal obligation, or the legitimate interests of the controller, unless unwarranted by the harm to the data subject. Using alternative data such as mobile money histories in a scoring model needs its own lawful basis, whatever consent the credit decision requires, and a business that licenses a third-party model should confirm that the data feeding it was lawfully obtained.

Cross-Border Expansion

A Kenyan authorisation applies in Kenya only. A business expanding into other East African markets should treat each regime as a separate licensing exercise and plan timelines for each. A foreign FinTech entering Kenya must satisfy the same NPSA, CBK Act and POCAMLA requirements as a local business, and foreign ownership of a regulated entity should be checked against the conditions of the specific licence category.