Microfinance Institutions in Kenya: CBK Licensing and Regulatory Requirements

Microfinance institutions in Kenya provide credit and, in some cases, savings services to small businesses and households that mainstream banks often do not reach. Anyone who wants to set up, buy into or lend through one needs to know which Central Bank of Kenya (CBK) regime applies, because the rules differ sharply depending on whether the business takes deposits from the public. This guide sets out the licensing and compliance position based on the statutes as they currently read.

Microfinance institutions in Kenya: the legal framework

The core statute is the Microfinance Act (Cap. 493C), administered by the CBK. As amended by Act No. 20 of 2024, it now speaks of microfinance banks: “deposit-taking microfinance business” is defined as microfinance bank business, and a “deposit-taking microfinance institution” is a microfinance bank. Section 3 applies the Act to every deposit-taking microfinance business. It also applies to non-deposit-taking microfinance business, which the Act defines as non-microfinance bank business involving the provision of physical credit, but only in the manner the Cabinet Secretary prescribes by regulations, and subject to any exemptions those regulations grant.

A separate regime sits in Part VIC of the Central Bank of Kenya Act, which regulates non-deposit-taking credit providers, including digital credit providers. The practical consequence is that a lender must first work out which of these two regimes, or both, captures its business model before it approaches the CBK.

Licensing a deposit-taking microfinance bank

Section 5 of the Microfinance Act requires an application to the CBK in the prescribed form. It must be accompanied by:

• the company’s memorandum and articles of association or other incorporating instrument;
• a verified notification of the registered place of business;
• the prospective place of operation, showing the head office and any branches;
• evidence that the company meets the minimum capital requirements in the Schedule;
• the prescribed fee; and
• a feasibility study report covering the objectives of the business, the economic and financial sector environment, the legal framework, risk analysis, financial analysis, organisational structure, proposed management and ownership.

Under section 6, the CBK may grant a licence if it is satisfied that the applicant meets the requirements of the Act, and it may endorse conditions on the licence and vary them later. A licence is valid until 31 December of the year of issue and may be renewed on application. Where a renewal application is made, the licence is deemed to continue in force until the application is determined.

Minimum capital and prudential ratios

Section 11 requires an institution to maintain the minimum capital requirements set out in the Schedule, which the Cabinet Secretary may amend by Gazette order. The Schedule requires, at all times, or such other ratios as the CBK determines:

• core capital of not less than ten per cent of total risk-adjusted assets plus risk-adjusted off-balance-sheet items;
• core capital of not less than eight per cent of total deposit liabilities;
• total capital of not less than twelve per cent of total risk-adjusted assets plus risk-adjusted off-balance-sheet items; and
• core capital of at least KES 60 million or, for a category of deposit-taking business prescribed under section 7, at least KES 20 million.

Section 7 allows the Cabinet Secretary to prescribe categories of deposit-taking business by reference to geography, administration or other criteria. Whether a particular proposal falls into a lower-capital category therefore depends on the prescribing instrument in force when the application is made, and it should be confirmed with the CBK rather than assumed. Section 12 separately requires institutions to hold the minimum liquid assets the CBK prescribes.

Fit and proper persons and deposit protection

Section 22A permits the CBK to assess the professional and moral suitability of any person managing or controlling an institution. A person who is not certified as fit and proper is deemed disqualified from holding office and must cease to hold it. Promoters should expect close scrutiny of directors and senior management.

Section 39 requires all institutions to contribute to the Deposit Protection Fund in the annual amounts and at the times the Deposit Protection Fund Board prescribes. Section 45 also restricts the use of the words “deposit-taking microfinance business”, or words indicating that business, to licensed persons, so an unlicensed company should not hold itself out as a deposit-taker.

Non-deposit-taking lenders and digital credit providers

Section 33S(1) of the Central Bank of Kenya Act provides that no one may carry on non-deposit-taking credit business unless licensed by the CBK or permitted to do so under another written law. An application must be made in the prescribed form with the prescribed fee and must include:

• a copy of the certificate of incorporation under the Companies Act;
• a certified copy of the memorandum and articles of association;
• a notification of the registered address;
• a certificate issued under section 19 of the Data Protection Act;
• a statement of compliance with Part VII of the Consumer Protection Act; and
• any other documents the CBK prescribes.

The CBK may grant or reject an application by written notice within sixty days of receipt. A licence remains valid unless suspended or revoked under the Act. Section 33R also empowers the CBK to prescribe an enforceable Code of Conduct binding non-deposit-taking credit providers and to determine parameters for the pricing of credit. For app-based lenders, see our guide to digital credit provider licensing in Kenya, which deals with that regime in more detail.

Consumer protection and anti-money laundering

The licence application for a non-deposit-taking credit provider has to show compliance with Part VII of the Consumer Protection Act and a Data Protection Act certificate, which signals that transparent disclosure of the cost of credit and lawful handling of borrowers’ personal data are conditions of entry, not afterthoughts. Lenders should draft loan agreements, disclosure statements and collection practices accordingly.

Under the Proceeds of Crime and Anti-Money Laundering Act, a “reporting institution” includes a financial institution. Reporting institutions must examine the background and purpose of certain transactions, record their findings in writing and report suspicious transactions to the Financial Reporting Centre. Whether a particular microfinance business is a reporting institution depends on how the Act defines financial institution, so each operator should confirm its status and build a compliance programme to match.

Practical points before you apply

Settle the business model first: deposit-taking means a microfinance bank licence under the Microfinance Act, while a pure lender will usually fall under the Central Bank of Kenya Act regime. Check the current capital, fee and category instruments directly with the CBK, because fee schedules and prescribed categories can change by subsidiary legislation. Prepare shareholder and director information early, since fit and proper assessment sits at the centre of the CBK’s review. Finally, keep the section 5 feasibility study realistic, since it is a required part of the application.

Frequently asked questions

This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.