The Central Bank of Kenya Amendment Act of 2021: Regulation of Digital Lenders

The Central Bank of Kenya Amendment Act of 2021 (the Act) came into force on 23 December 2021. The principal objective of the Act is to provide licensing requirements for digital (meaning online or app-based) credit service providers (digital lenders) in Kenya. The Act comes amidst complaints of unethical  and predatory practices by digital lenders imposing steep lending rates, unsolicited communications with customers contacts, and borrower shaming of customers who default on repayment. The accompanying draft Central Bank of Kenya (Digital Credit Providers) Regulations of 2021 (Draft Regulations) were also recently circulated for public comments.

2 Feb 2022 6 min read Corporate & Commercial Article

At a glance

  • The Central Bank of Kenya Amendment Act of 2021 came into force on December 23, 2021, to regulate digital credit service providers in Kenya.
  • The Act aims to address complaints about unethical practices by digital lenders, including high lending rates and borrower shaming.
  • It grants the Central Bank of Kenya the power to license and supervise digital lenders, introduces licensing and application requirements, and proposes consumer protection provisions through the draft regulations. Non-compliance can result in penalties, fines, and imprisonment.

Notably, Kenya is among the few jurisdictions that have specifically regulated on digital lending. In most jurisdictions, digital lenders are regulated by laws such as consumer protection, microfinance, money lending or general finance laws. In Uganda, for instance digital lenders are regulated under the Microfinance Institutions and Money Lenders Act, 2016 (MIMLA), which sets out licensing requirements like the Act. However, in comparison to the Act, MIMLA is not as robust in its consumer protection provisions, making the standards set in the Act conceivably more onerous. By contrast, in jurisdictions such as Poland, regulators have not taken a licensing approach but have instead imposed a consumer protection regime to govern a digital lender’s practice. South Africa’s approach is perhaps the closest to the Act, even though digital lenders are regulated under national consumer credit laws, tNational Credit Act Regulations of 2005 provides for both licensing and robust consumer protection provisions.

Specific regulation on digital lending is not common, as most jurisdictions do not differentiate between digital lenders and other lenders. The establishment of the Act therefore positions Kenya at the forefront of this area.

Powers of the Central Bank of Kenya

The Act grants the Central Bank of Kenya (CBK) power to license and supervise digital lenders. In addition, it further empowers the CBK to approve channels through which a digital credit business is conducted, determine pricing parameters for digital credit and suspend or revoke licences of digital lenders. The implications of these powers mean that the discretion previously enjoyed by digital lenders, will be limited and subject to CBK approval. For instance, a digital lender will be required to amend its pricing parameters for credit products and services, if the CBK’s parameters do not align with that of the digital lender. Further, if the Draft Regulations are passed as currently drafted, a digital lender will be prohibited from changing its pricing model or parameters without the CBK’s written approval.

Licensing and Application Requirements

The Act requires any person carrying on or intending to carry on digital credit business to apply for a licence with the CBK. In order to successfully apply, a digital lender must, among other requirements:

  • be incorporated under the Companies Act of 2015;
  • be registered as a data controller or data processer under the Data Protection Act of 2019 (DPA); and
  • comply with the credit agreement provisions of the Consumer Protection Act of 2012.

It is possible that the timelines indicated in the Act may be extended, given that the DPA regulations, although recently published, are still awaiting approval from the National Assembly. Nevertheless, digital lenders should familiarise themselves with the requirements for registration as a data controller or processor and attend to the other licensing requirements.

Once an application for a licence is submitted, the CBK shall either grant or reject the application within 60 days and then gazette and publish the names and addresses of all licensed digital lenders on the CBK website.

CBK Transitional Requirements

Pursuant to the Act, the CBK issued a notice that all digital lenders are now required to provide their details by the 14 January 2022, to facilitate a smooth transition from an unregulated to a regulated environment. According to the notice, the purpose of this is to form the basis of early engagement between the CBK and digital lenders, to ensure effective implementation of the Act. Please note that this requirement is separate from the requirement to apply for a licence, as licencing will only begin once the Draft Regulations are enacted. Additionally, from our reading of the notice, this requirement does not appear to be mandatory, as it states that the CBK “advises all unregulated digital lenders to provide their details.” It therefore appears to be an effort from the CBK to understand the market and collect data.

Digital lenders and those intending to enter into the market are advised to refer to the CBK website if they are yet to comply with this requirement.

The Draft Regulations

The Draft Regulations propose to introduce further application requirements. For instance, a digital lender’s significant shareholders, directors, and chief executive officer (CEO) will need to meet the fit and proper obligations. In order to meet this, a digital lender will be required to provide information relating to a director’s and CEO’s educational and professional qualifications, employment and business records, as well as the past and present activities of their directors and CEO in Kenya and abroad, to name a few. In addition, a digital lender may be required to provide the source of their shareholder’s funds.

Moreover, the Draft Regulations propose to prohibit unauthorised or unsolicited communication with a customer’s contacts, to prohibit improper or unconscionable debt collection tactics, and to promote fair credit collection practices. Additionally, if passed, a digital lender will be obligated to establish consumer protection provisions. For instance, digital lenders will need to create a customer complaints mechanism and ensure that all complaints are addressed within 30 days; and thereafter, maintain a record of complaints and the outcome of their resolution. Failure to which, the CBK is entitled to impose a number of administrative sanctions, including a monetary penalty not exceeding five hundred thousand shillings (Kshs 500,000 approximately USD 4,500) on the Digital Lender, its directors, officers or employee’s responsible for the non-compliance. Notably, this monetary penalty is for each violation of non-compliance, therefore it may exceed the stated amount if the Digital Lender engages in more than one violation. Other sanctions include suspension or disqualification from office of the non-compliant director, officer, or employee, as well as more frequent CBK inspections into the Digital Lender’s operation, to name a few.

Timelines and Fees

The Act requires all digital lenders to be registered with the CBK within six months of the publication of the Draft Regulations. Moreover, the Act stipulates that the Draft Regulations must be enacted within three months of the Act, which is in March 2022. As such, digital lenders have until September 2022 to register with the CBK. Failure to which, a fine of five million shillings (Kshs 5,000,000 approximately USD 44,000) and/or imprisonment for a term not exceeding three years shall be imposed upon conviction. 

In relation to fees, the Draft Regulations propose that the application fee be five thousand shillings Kshs 5,000 approximately USD 44), whilst the annual fee be twenty thousand shillings (Kshs 20,000 approximately USD 175). Please note that the fees and all other provisions of the Draft Regulations may be subject to change, as they are still going through the legislative process. We shall keep you updated of any changes that occur.


The guardrails in the digital lending market have been raised after years of unregulated operation. The Act was established to provide oversight and create a more stable, responsible, and level marketplace for digital lenders and borrowers. Some stakeholders cautioned against overly onerous, and prescriptive regulation that would undermine financial inclusion. It stands to be seen in the coming months, whether the Act and the Draft Regulations will undermine or promote financial inclusion. Nonetheless, existing digital lenders and those who intend to enter the market need to prepare to comply with the above requirements by September 2022. 

The information and material published on this website is provided for general purposes only and does not constitute legal advice. We make every effort to ensure that the content is updated regularly and to offer the most current and accurate information. Please consult one of our lawyers on any specific legal problem or matter. We accept no responsibility for any loss or damage, whether direct or consequential, which may arise from reliance on the information contained in these pages. Please refer to our full terms and conditions. Copyright © 2024 Cliffe Dekker Hofmeyr. All rights reserved. For permission to reproduce an article or publication, please contact us