Regulatory Sandbox Kenya: Fintech, Innovation and Testing Regulatory Frameworks

A regulatory sandbox in Kenya is a supervised testing arrangement that lets an innovator trial a new product with real customers, within limits agreed with the regulator, before a full licence is granted. The best documented example is the Capital Markets Authority (CMA) sandbox. This guide explains how that regime works, what the CMA’s own instrument says about eligibility, duration and safeguards, and what fintech founders should check before assuming that a sandbox exists with another regulator.

What the regulatory sandbox Kenya framework rests on

The CMA’s sandbox is governed by its Regulatory Sandbox Policy Guidance Note of March 2019. The Note is issued under section 12A of the Capital Markets Act, which lets the Authority issue guidelines and notices to carry out its functions. It is a policy instrument, not an Act of Parliament and not regulations made by the Cabinet Secretary, so it sets how the Authority will administer testing rather than creating new statutory rights. The CMA’s sandbox page describes it as aimed at fintech companies and existing capital markets intermediaries.

Who can apply

Under paragraph 6 of the Note, an applicant must have its company incorporated in Kenya or be licensed by a securities market regulator in an equivalent jurisdiction, and must intend to offer the innovative product in Kenya after exiting the sandbox. The Note defines an applicant as a company limited by shares. A foreign fintech without a Kenyan company can therefore qualify if it holds the right overseas licence, a point many summaries miss. The product must also be genuinely innovative, and the Note requires the applicant to explain why the product cannot be tested under existing rules.

Testing period

Paragraph 16 provides that the initial testing period is settled in consultation between the Authority and the participant and shall not exceed twelve months. Where a product has tested positively and extended testing is needed for identified issues, the Authority may extend it for a further period of up to twelve months. Plan the product roadmap around that cap, because the Note gives no automatic right to stay in the sandbox.

Safeguards and consumer protection

Customer protection is built into the process. Paragraph 22 requires tests to include safeguards that manage risk and limit the consequences of failure for customers and investors. Paragraph 24 requires a Safeguards Plan covering integrity, conduct and investor protection, including compliance with anti-money laundering and counter-terrorism financing rules. Paragraph 8(2)(a) requires a plan for transitioning or compensating customers if the product is discontinued. Paragraph 26 lists grounds on which participation can be suspended or revoked, including detriment to customers or investors. Treat these as drafting requirements for the application, not as a formality.

Anti-money laundering still applies

A sandbox does not suspend the Proceeds of Crime and Anti-Money Laundering Act, 2009. Whether a participant is a reporting institution depends on what it does, and the Note itself requires AML and counter-terrorism financing compliance in the Safeguards Plan. Read our guide to reporting to the Financial Reporting Centre before you design customer onboarding.

Other regulators and virtual assets

Founders often assume the Central Bank of Kenya, the Insurance Regulatory Authority and the Communications Authority run sandboxes on the same pattern. We checked the CBK’s published legislation and guidelines page and did not find a sandbox framework listed there, and we have not verified sandbox instruments for the other regulators. Ask each regulator in writing what testing arrangements exist before you rely on one. Virtual asset businesses should note that the Virtual Asset Service Providers Act, 2025 creates a licensing regime of its own; the text of the Act does not mention a sandbox. See our overview of Kenya’s virtual asset licensing regime.

Graduation, exit and licensing

The regulatory sandbox in Kenya is a bridge to licensing, not a substitute for it. A participant that completes testing still has to obtain whatever licence its activity requires, and a participant that fails to meet the conditions of the Note can be suspended or removed. Founders should agree an exit plan with the Authority at the outset, covering what happens to customer funds and data, how customers are told, and which licence will be sought. Investors and banking partners will ask for this plan, because it shows whether the business can operate lawfully once the temporary comfort ends. Where the product touches several regulators, for example payments and securities together, seek written clarity on who leads, since a sandbox admission by one regulator does not bind another.

Preparing a strong application

Applications fail when the product is not genuinely innovative, when the safeguards are thin or when the applicant has no credible route to a full licence. Prepare a short product description, a risk assessment, the Safeguards Plan, an exit and customer-transition plan, and a map of the licence you will apply for at graduation. Build compliance in parallel with the product, because the relaxations end when testing ends. Our guide to CMA licensing in Kenya covers the licences a sandbox graduate may need.