Robo-Advisers in Kenya: Licensing Automated Investment Advice

Robo-advisers, the apps and platforms that recommend investments or build portfolios using algorithms with little or no human input, now have an express place in Kenyan capital markets regulation. The Capital Markets (Licensing Requirements) (General) Regulations, 2025 (Legal Notice No. 197 of 2025) bring automated advice within the investment adviser licence and add a set of platform-specific requirements. This article explains how a robo-advisory business is licensed in Kenya and what the Capital Markets Authority (CMA) expects of its technology.

Automated advice is investment advice

Section 23(1) of the Capital Markets Act (Cap. 485A) prohibits carrying on business as an investment adviser, or holding out as one, without a CMA licence. The Act defines an investment adviser as a person who, for remuneration, carries on the business of advising others concerning securities, or regularly issues analyses or reports concerning securities.

The 2025 Regulations remove any doubt about software. Regulation 2 provides that “investment advisor” has the meaning given in the Act and includes digital platforms that provide automated, algorithm-driven investment advisory services with little to no human supervision. A platform that recommends securities to users for a fee or as part of a paid service is therefore treated as an investment adviser, whether or not a human adviser reviews the output.

The Regulations do not separately define “algorithm-driven” or use the term robo-advisory. The test is functional: automated advice about securities, delivered through a digital platform.

The base requirements still apply

A robo-adviser must first meet the ordinary investment adviser requirements in regulations 12 and 13. In summary, the applicant must be a company or limited liability partnership incorporated or registered in Kenya, show adequate financial resources, hold professional indemnity insurance of at least KES 500,000, have an approved registered office and an independent auditor, and file a business plan. Its directors and chief executive officer must be fit and proper, and its advisory representatives must have at least three years’ relevant experience and belong to a professional body. Our guide to the investment adviser licence under the 2025 Regulations sets these out in full.

The additional platform requirements

Regulation 14 applies where an investment adviser uses a digital platform for automated, algorithm-driven advice. On top of regulations 12 and 13, the applicant must have:

• its principal bank account in Kenya;
• adequate capital and resources for efficient operations;
• adequate, secure and reliable systems for the platform;
• documented, robust processes, methodologies and procedures for the platform;
• a risk management framework that covers the risks of the platform;
• client onboarding procedures and a checklist; and
• a data protection policy that safeguards data integrity, security, confidentiality and privacy, and keeps all relevant documents for at least seven years.

What the CMA is likely to probe

The requirements translate into questions an applicant should be ready to answer with documents, not assurances.

• Methodology. How does the algorithm reach a recommendation? What data does it use, how are risk profiles built, and who approves changes to the model?
• Suitability at onboarding. How does the platform gather enough information about a user to give suitable advice, and what happens when the answers are inconsistent?
• Oversight. “Little to no human supervision” describes the service, not the governance. Someone senior must own the model, monitor its outputs and be able to switch it off.
• Resilience. What happens during an outage, a data error or a market shock, and how are users told?
• Records. Can the business reproduce the advice a user received, and the data behind it, for at least seven years?

Data protection and marketing

A robo-adviser processes personal and financial data at scale, so the Data Protection Act, 2019 applies alongside the CMA rules. That covers registration with the Office of the Data Protection Commissioner where the business meets the registration thresholds, lawful bases for processing, and rules on automated decision-making and cross-border transfers. The data protection policy required by regulation 14 should be written with both regimes in mind.

Marketing is also regulated. Regulation 55 prohibits marketing securities in Kenya to the general public or a section of it, by advertising, solicitation, invitation or other means, unless the marketer is licensed under the Regulations. App store listings, social media campaigns and referral programmes for a robo-advisory product are all forms of marketing and should not start before the licence is in place.

Ongoing obligations

Once licensed, a robo-adviser has the same reporting duties as any investment adviser under regulation 15: monthly risk-based capital adequacy reports and management accounts within fifteen days of each month end, and audited financial statements within three months of the financial year end. Under regulation 53, it must also update its business plan after any material change, which for a platform business can include a significant change to the model or the product.

Frequently asked questions

This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.