Getting a CBK authorisation is the start of the compliance work, not the end of it. A Kenyan payment service provider (PSP) must renew, report, handle complaints, keep records, and tell the Central Bank of Kenya (CBK) before it changes anything material. This article sets out those continuing duties under the National Payment System Regulations, 2014 and shows where the draft National Payment System Bill, 2026 would change them.
Renewal of authorisation
Regulation 9(1) requires a renewal application at least two months before the authorisation expires. It must be made on Form 2, be accompanied by any other information CBK requires, and be submitted with the annual renewal fee set out in the First Schedule. Diarise the date from the day the authorisation is issued, and do not leave the application to the last fortnight.
Reports and audits
Regulation 29 sets a regular reporting rhythm:
- Every month: within ten days of month end, a return in the Fifth Schedule form covering transaction volumes, values and geographic distribution, incidents of fraud, theft or robbery, material service interruptions and major security breaches, and complaints received and resolved.
- Every year: within three months of 31 December, audited financial statements for Kenyan activities, separate audited statements for the provider and the trust accounts, and an independent system security audit report.
- Records: an audit trail of every transaction from origin to finality, and records of every electronic transfer kept for at least seven years.
Regulation 34 also requires an external auditor who is a member of good standing of the Institute of Certified Public Accountants of Kenya, appointed at the provider’s own expense, and CBK may widen the audit scope. Regulation 31 requires systems capable of screening transactions for compliance with the Proceeds of Crime and Anti-Money Laundering Act and the Prevention of Terrorism Act.
Telling CBK before you change things
Three notice duties catch growing businesses out:
- Product changes. Under Regulation 13, a substantial change or enhancement to the service needs thirty days’ prior notice. That includes new electronic channels, changing the payment service providers and other major partners in the business, and any change to the documents given at application.
- New agents and cash merchants. Under Regulation 16, notify CBK at least fourteen days before the agency starts, with the recruitment procedure, the draft agreement, the technology to be used and the training materials.
- Outsourcing. Under Regulation 23, notify CBK at least thirty days before an outsourcing agreement is implemented. A material operational function cannot be outsourced in a way that weakens internal control or CBK’s ability to monitor compliance, and the contract must let CBK exercise its oversight powers over the third party.
Agents and cash merchants
A provider may appoint agents, but Regulation 14(4) makes it liable to customers for the conduct of its agents within the scope of the agency agreement, and the agreement cannot exclude that liability. Under Regulation 17 the agent must hold the registration or licence its business needs, be able to lawfully provide the service, and hold a payment account with a bank, financial institution or payment service provider. Agent contracts for retail cash services cannot be exclusive (Regulation 15(2)).
Complaints and customer terms
Within six months of starting to provide services, the provider must set up a customer care system (Regulation 38). It must acknowledge complaints, tell the customer the expected timing, handle complaints free of charge, and resolve them within thirty days (Regulations 39 and 40). A customer who is not satisfied may appeal to CBK. The provider must also have a customer service agreement with every customer and file the standard agreement for each service with CBK (Regulation 41).
What the 2026 Bill would change
The Bill is a draft, and comments closed on 9 October 2026. If enacted as published, it would repeal the Act (clause 78) and require existing providers to comply within one year of commencement (clause 79). Its continuing duties are broader and less detailed than the Regulations:
- Clause 27 sets market conduct duties: clear information on fees and risks, safeguarding customer funds, accessible complaint handling and data protection.
- Clause 30 requires prior written CBK approval before outsourcing an operational function. Regulation 23 today needs notice, not approval, so this is a tightening.
- Clause 31 keeps agent liability with the provider and leaves the detail to CBK and regulations.
- Clause 33 requires immediate notice of a material event, including a data breach, a prolonged outage, loss of customer funds, insolvency risk, enforcement action and any material change in ownership or control.
- Clauses 34 and 35 require audited accounts and a system audit report within three months of year end, prepared by an auditor approved by CBK.
The practical point is that “notify within thirty days” would become “obtain approval first” for outsourcing, and “immediately” for material events. Build both into your governance now.
How We Can Help
We build compliance calendars for newly licensed providers, draft agent and outsourcing agreements that satisfy Regulations 14 to 17 and 23, and prepare CBK notifications. Read our guides on PSP licensing in Kenya, trust account rules and the Payment System Bill 2026. For AML duties see our note on AML risk assessment for fintechs and on reporting to the Financial Reporting Centre. Our financial services team at Clay & Associates Advocates can help. For AML, FRC and ODPC registration duties, see our note on PSP AML, FRC and data protection duties.
Sources: National Payment System Regulations, 2014, regulations 9, 13 to 17, 23, 29, 31, 34 and 38 to 41 (CBK); The National Payment System Bill, 2026, clauses 27, 30, 31, 33 to 35, 78 and 79 (CBK).
Frequently asked questions
When must a PSP apply to renew its CBK authorisation?
At least two months before expiry, on Form 2 with the annual renewal fee (Regulation 9(1)).
How often must a PSP report to CBK?
Monthly, within ten days of month end, and annually within three months of 31 December (Regulation 29).
Is a PSP responsible for what its agents do?
Yes. Regulation 14(4) makes the provider liable to customers for agent conduct within the scope of the agency, and the agreement cannot exclude that.
Do I need CBK approval to outsource a function?
Today you must notify CBK thirty days ahead (Regulation 23). Under the draft Bill, prior written approval would be needed (clause 30).
Need advice on your own matter?
Tell us what you are dealing with. You will know what it involves and what it costs before you commit.
This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.
