Open Banking in Kenya Under the Payment System Bill 2026

Open banking lets a customer permit a third party to initiate payments from, or read information about, their accounts held elsewhere. Kenya’s current payments law does not create separate licence categories for these services. The draft National Payment System Bill, 2026 would, creating two licence categories, imposing data-sharing duties on providers and allowing a regulatory sandbox. This article explains what the Bill says, what is still left to regulations, and how a fintech should prepare.

The two new licences

The Bill’s definitions describe both services as “open finance” services:

• A payment initiation service allows users to initiate online payments without directly interacting with their bank or financial services provider, with the payment initiation service provider accessing and processing payments on their behalf.
• An account information service provides consolidated information on one or more payment accounts held by a user with one or more other payment service providers.

The First Schedule lists a Payment Initiation Service Provider and an Account Information Service Provider as separate payment service provider licence categories. The Third Schedule sets minimum capital at KES 5 million for each, the lowest of the payment service provider categories (a money remittance provider needs KES 30 million, a merchant acquirer or e-wallet provider KES 50 million and an e-money issuer KES 250 million). Clause 4(1), which says to whom the Bill applies, separately covers anyone who owns, operates, manages or controls a payment initiation service or an account information service.

What providers must do

Open finance is defined as access, with the customer’s permission, by a third party to the customer’s data held by a payment service provider or payment system operator, to provide new and enhanced services. Two clauses give it force:

• Clause 29 requires every payment service provider and payment system operator to use systems capable of securely sharing customer data with third parties for open finance purposes. CBK may require a provider to implement a mechanism to share data securely after obtaining the customer’s consent, and CBK must make regulations to give effect to the clause.
• Clause 28 requires systems that are interoperable with those of other providers, operators and their agents. CBK may require a provider to enter into an interoperability arrangement, and a failure to comply exposes the provider to administrative enforcement action.

Read together, a bank, wallet or mobile money provider would have to be technically ready to be connected to. Clause 29 does not itself say how fast, on what technical standard, or whether the provider may charge. Those answers are left to regulations that are yet to be made.

Gaps and risks to plan around

• Standards. Clause 29(3) leaves the data-sharing rules to regulations, so API standards, authentication, liability for unauthorised payments and any fee limits are open points.
• Consent and data protection. Customer consent is the trigger for sharing. Data protection duties apply in parallel, and our note on cross-border data transfer compliance covers the offshore processing issues many open banking products raise.
• Market conduct. Clause 27 applies to every provider, including clear information on fees and risks, protection of customer data and complaint handling.
• Capital is not the whole cost. Fit and proper vetting of directors and significant shareholders, systems audits under clause 35 and a possible trust or safeguarding model (if you touch funds) all add cost.

The sandbox route

Clause 74 lets CBK, by regulations, establish a regulatory sandbox framework governing how a person may obtain limited access to the national payment system to test innovative services without necessarily obtaining a licence under the Act. The framework would set criteria and minimum requirements. No framework exists in the Bill itself, so early-stage open banking builders should watch for it rather than plan around it. Until a framework is published, assume that an unlicensed pilot with live customer accounts carries enforcement risk, and speak to CBK before launch rather than after.

Preparing now

• Map what your product does against the two definitions. Initiating a payment and merely displaying balances are different licences.
• Confirm whether you touch customer funds at any point, because that changes the capital tier and may add trust duties.
• Build consent capture and revocation into the product, since consent is the legal trigger for data sharing.
• Agree commercial terms with the banks and wallets you connect to, because clause 29 does not settle fees or liability.
• Prepare the fit and proper material for directors and significant shareholders, using the Bill’s Second Schedule criteria.

Timing

The Bill is a draft and comments closed on 9 October 2026. If enacted, it repeals the current Act (clause 78) and requires anyone providing payment services to comply within one year of commencement (clause 79). A business doing account aggregation or payment initiation today without a licence should assess its position now, because the Bill’s transition clause contains no savings of existing arrangements.

Frequently asked questions

This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.