Unlicensed Lenders in Kenya: The March 2027 CBK Deadline

Lenders that have been operating outside the Central Bank of Kenya (CBK) regime now have a fixed deadline. Regulation 96 of the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026 (Legal Notice 191 of 2026) gives any person already carrying on non-deposit taking credit business six months from publication to apply for a licence or registration. The Regulations were published and commenced on 29 September 2026, so the window closes on 29 March 2027. This article explains who the deadline catches, what happens to existing digital credit provider licences, and what a lender should be doing now.

Who the Deadline Applies To

Regulation 96(1) applies to a person who, at commencement, was conducting non-deposit taking credit business that is not regulated under any other written law. That category is now much wider than the old app-based lenders. Since the Business Laws (Amendment) Act, 2024, the Central Bank of Kenya Act defines non-deposit taking credit business to include:

• granting loans or credit facilities to members of the public or a section of it, whether or not digitally;
• asset financing, whether directly or through a third-party financier;
• buy now pay later arrangements as determined by CBK, other than hire purchase agreements governed by the Hire-Purchase Act;
• credit guarantees, pay as you go arrangements, and peer to peer lending under collective investment schemes; and
• any other activity CBK determines to be non-deposit taking credit business.

Many businesses that never thought of themselves as lenders sit inside that list: boda boda and phone financiers, solar pay as you go companies, school fees and salary advance platforms, and merchants running their own instalment plans. If your business was doing any of these on 29 September 2026 and no other statute already regulates it, the deadline applies to you. Our article on the exemptions from the 2026 Regulations explains where the boundaries lie.

What Happens If You Apply in Time

Regulation 96(2) allows an applicant under regulation 96(1) to continue conducting non-deposit taking credit business while CBK determines the application, subject to the Act, the Regulations and any conditions CBK issues. That protection is tied to being “an applicant under paragraph (1)”, so it depends on lodging the application within the six-month window. A lender that misses 29 March 2027 has no transitional cover and is carrying on business without authorisation.

The consequence is serious. Section 33S(10) of the Central Bank of Kenya Act makes it an offence to contravene section 33S, punishable on conviction by imprisonment for up to three years, a fine of up to five million shillings, or both.

What Happens to Existing DCP Licences

Lenders already licensed under the revoked Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 do not have to reapply. Regulation 96(3) provides that they are not affected by the registration requirements and continue to operate as if licensed under the 2026 Regulations, and regulation 96(4) deems them licensed under the new Regulations. Rights accrued and liabilities incurred under the 2022 Regulations continue (regulation 96(5)), and any licence application pending at commencement is processed under Part II or Part III of the 2026 Regulations, as the case may be (regulation 96(6)).

Being deemed licensed is not the same as being unaffected. A former digital credit provider is now a licensed non-deposit taking credit provider and carries every obligation of that status, including:

• the annual licence fee of KES 500,000 under the Third Schedule, due by 31 December, against KES 20,000 under the old regime;
• the expanded debt collection prohibitions in regulation 30, which now cover calls outside working hours and repossession by intimidation;
• the duties on the use of artificial intelligence in lending decisions in regulation 60; and
• CBK approval for shareholding changes of ten percent or more under regulation 22.

A former licensee should treat the transition as a compliance review, not a formality.

Steps to Take Before 29 March 2027

Six months is shorter than it sounds once the document requirements are mapped. A realistic plan works backwards from the deadline:

1. Confirm you are in scope. Check the business model against the statutory definition and the exclusions in regulation 3(3). Do this in writing; it is the first thing a regulator or investor will ask for.
2. Choose the route. Initial capital of not less than twenty million shillings means a licence under regulation 6; below that, registration under regulation 9. Our article on the KES 20 million licence or registration test explains the difference.
3. Deal with the name. Regulation 4(12) requires an existing business to give CBK a letter of no objection from the Kenya Industrial Property Institute on the use of its reserved company name, and a high-level brief of its business strategy.
4. Collect personal documents early. Both routes require a certificate of good conduct, tax compliance certificate and credit reference bureau report for each individual significant shareholder, director, chief executive officer and senior officer. Foreign shareholders and directors take longest.
5. Register with the Data Protection Commissioner. A certificate issued under section 19 of the Data Protection Act is a listed document on both routes.
6. Write the policies. Credit, consumer protection, AML/CFT, data protection and corporate governance policies, a code of conduct, pricing parameters and business continuity plans all form part of the application.
7. Budget for the fees. The application fee is KES 100,000 on either route.

Frequently asked questions

This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.