The CBK has now developed and published for public comment the Draft Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2025 (Draft Regulations) with the intention of operationalising these amendments to the CBK Act and settling the regulatory framework for regulation of non-deposit taking lenders. Key features of the Draft Regulations are discussed below.

Expanded scope of regulation

The Draft Regulations propose to regulate non-deposit-taking credit providers (NDTCPs) by ensuring that lending in both digital and non-digital forms is regulated. Digital credit providers were previously regulated under the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 (2022 Regulations). The amendments to the CBK Act effectively repeal the 2022 Regulations, and digital credit providers will be regulated under the Draft Regulations, once in force.

NDTCPs that previously operated without CBK oversight will now fall within the regulatory net. For such lenders, the Draft Regulations mean closer scrutiny of ownership and governance, formal vetting of investor participants, and detailed justification of funding sources.

Licensing and registration thresholds

Entities with initial capital above KES 20 million will require a licence from the CBK in order to operate, while those below this threshold will be required to register with the CBK in order to operate. Any registered NDTCP that subsequently exceeds the KES 20 million in capital, borrowings or loan book value will be required to convert their registration to a licence. The mechanics for such conversion remain unclear and it appears that a new application for a license will be required.

Governance and fit-and-proper standards

Significant shareholders, directors and senior officers must obtain CBK clearance before appointment or before they can acquire shares. The CBK will also have the power to direct a significant shareholder who does not pass the fit-and-proper test to dispose of their shares so that they remain with less than 10%.

Further, transfer of 10% or more of the issued shares in a licensed or registered NDTCP will require prior CBK approval. This provision will have a direct impact on mergers and acquisitions involving NDTCPs. Transaction timelines will need to factor in the regulatory review and approval process, and failure to comply could result in the invalidation of a merger or revocation of the license or registration.

Product and pricing controls

The CBK will have strict oversight over product development and pricing. NDTCPs will be required to obtain CBK approval before introducing new products or changing the features of existing ones. Pricing models will be required to disclose all cost components, present an all-inclusive annual percentage rate and factor in credit reference bureau scores when applying risk-based pricing. The CBK will also have the authority to adjust the pricing parameters.

These measures will limit interest rate flexibility, as changes to lending products and modifications to pricing (interest rates and fees) must be pre-approved by the CBK.

Consumer protection enhancements

The amounts recoverable from non-performing loans will be capped at the outstanding principal plus an equal amount in interest and reasonable recovery expenses. Abusive debt collection practices such as accessing a borrower’s contacts, shaming or harassment are also prohibited. In addition, lenders will be expected to provide transparent loan agreements, allow early repayment without penalty, and maintain clear mechanisms for handling customer complaints. Additionally, any new digital channels, mobile applications, payment platforms such as paybill numbers, or bank accounts intended for lending activities may only be introduced with prior approval from the CBK. In addition, NDTCPs will be required to provide borrowers with clear and accessible mechanisms to opt out of all marketing communications.

Restrictions on activities and outsourcing

NDTCPs will be limited in the activities they can engage in. Prohibited activities include deposit-taking, accepting cash as loan security, conducting foreign exchange business and offering payment services without the appropriate separate licence. In addition, outsourcing rules prevent the delegation of core functions such as loan approval and portfolio management. Notably, outsourcing contracts must provide for the CBK’s right of oversight and access to the service provider’s premises, books, records, systems, employees and any other information the CBK requires.

Conclusion

Regulation of all NDTCPs raises compliance and transaction costs but offers potential long-term benefits through enhanced market credibility, reduced reputational risk and a more transparent lending environment. Deal structuring, governance arrangements and product strategies will need to incorporate regulatory approval processes at an early stage to avoid delays or sanctions.

The CBK has been receiving comments from the public on the Draft Regulations. After the consultation period, the CBK will review submissions, make any necessary amendments, and proceed to finalise and gazette the regulations, after which they will come into force on the date specified in the legal notice.