We have set out the key features of the Regulations below. Importantly, the Regulations were largely adopted in their draft form, which we have discussed in an earlier alert. For more information on the implications of the Act and the Regulations (then referred to as the ‘Draft Regulations’), please see our previous alert and podcast on this topic.

Application requirements and process

In order to apply for a licence, digital lenders are advised that they will need to complete an application form as prescribed in the Regulations and, among other things, provide the CBK with:

• a description of the ICT system to be used in the digital lender’s operations and an independent assurance on the systems;
• a description of the delivery channels or platforms to be used, as well as a description of the terms and conditions of the credit products and services to be provided;
• an anti-money laundering and combating the financing of terrorism policy and procedure;
• a data protection policy and procedure;
• a consumer redress mechanisms policy and procedure; and
• a description and evidence of the sources of funds to be invested in the digital lender, to name a few.

Notably, the Regulations depart from the position in the draft regulations which proposed to make registration as a data controller or processor under the Data Protection Act, 2019 (DPA) a prerequisite to this application for a digital lending licence. As we previously explained, this requirement was foreseeably difficult, because at the time, the DPA regulations that were to govern the registration of a data controller or processer were yet to be published. As at the date of this alert, the DPA regulations have been enacted; although, the Regulations no longer require this as a precondition to a digital lenders licence. Instead, digital lenders are only required to provide the CBK with a data protection policy and procedure. Digital lenders are therefore advised that they do not need to register with the Office of the Data Commissioner prior to obtaining a licence with the CBK.

Once an application is submitted, the Regulations provide that the CBK will consider the history of the digital lender; the professional and moral suitability of the persons proposed to manage or control the digital lender; the source and evidence of funds to be invested by or in the digital lender; as well as the public interest element in licensing the applicant digital lender. This requirement to consider the public interest creates a new and interesting aspect of the licensing process. It will be interesting to observe how the public interest is considered during the application process and how much value is ascribed to matters of public interest. This approach does however align itself with the CBK’s position set forth in their press release, which stated that the Regulations were enacted to “address the concerns raised by the public”.

Furthermore, the Regulations provide that upon considering the factors outlined above, the CBK will within 60 days, either grant the licence, grant the licence subject to conditions, or reject the application. Thereafter, the CBK will within 30 days publish the names of the digital lender on the CBK website. 

Notification requirements

The Regulations provide that a digital lender must notify the CBK of its significant shareholders, director, chief executive officer (CEO) or senior officer, to obtain certification that these persons are fit and proper to perform the intended function. Digital lenders are advised that they will need to fill in the prescribed forms in relation to each of these persons and submit them to the CBK for approval.

The Regulations further grant the CBK the power to assess the suitability of these individuals from time to time, where it considers it necessary. Therefore, digital lenders should ensure that the fit and proper requirements set forth in the Act are met at all times. Any changes in the significant shareholding, board or management structure or any appointment of a new director or senior officer will warrant notification to the CBK, at least 30 days prior to the effective date of the intended change or appointment.

Timelines, fees and returns

According to the press release, all digital lenders must be registered with the CBK by 17 September 2022, failure to which they must cease operations.

Furthermore, the Regulations have confirmed that the fee for a licence is five thousand shillings (Kshs 5,000 approximately USD 45), whilst the annual fee is twenty thousand shillings (Kshs 20,000 approximately USD 175).

In relation to returns, the Regulations require digital lenders to submit an annual return to the CBK certifying that it has complied with the provisions of the Act and the Regulations. Failure to which, the CBK is entitled to impose a number of administrative sanctions, including a monetary penalty not exceeding five hundred thousand shillings (Kshs 500,000 approximately USD 4,500) on the digital lender, its directors, officers or employee’s responsible for the non-compliance. Other sanctions include suspension or disqualification from office of the non-compliant director, officer, or employee, as well as more frequent CBK inspections into the digital lender’s operation, to name a few. The Regulations further provide that the CBK will determine the administrative sanctions on a case-by-case basis, meaning that different sanctions may be imposed for different violations and against different digital lenders.

Conclusion

The Regulations seek to address concerns raised by the public over the last few years in response to the significant growth of digital lending in Kenya. The Act was established to provide oversight and provide for consumer protection, credit information sharing and outline the obligations of digital lenders in Kenya. The enactment of the Regulations now give force to the Act and have made the provisions of the Act operational and enforceable.

Existing digital lenders, and those who intend to enter the market are advised to begin the application process to ensure that they meet the 17 September 2022 deadline.