Unpacking the Central Bank of Kenya’s Digital Credit Providers Regulations of 2022

On March 18 2022, the Central Bank of Kenya (CBK) published and operationalised the CBK Digital Credit Providers Regulations, 2022 (the Regulations). The Regulations accompany the recent enactment of the CBK (Amendment) Act, 2021 (the Act), which came into force on 23 December 2021. The principal objective of the Act is to provide licensing requirements for digital lenders in Kenya. The Regulations therefore provide the procedures and processes to follow in applying for these licences and complying with the provisions of the Act. 

24 Mar 2022 5 min read Corporate & Commercial Alert Article

At a glance

  • The Central Bank of Kenya (CBK) has published and implemented the CBK Digital Credit Providers Regulations, 2022, along with the CBK (Amendment) Act, 2021, to regulate digital lenders in Kenya.
  • Digital lenders need to complete an application form and provide various information, including descriptions of their ICT system, delivery channels, credit products and services, anti-money laundering policies, data protection policies, consumer redress mechanisms, and evidence of funding sources.
  • The CBK will assess the digital lender's history, management suitability, funding sources, and public interest before granting, conditioning, or rejecting the license within 60 days. Digital lenders must also notify the CBK of significant shareholders, directors, CEOs, and senior officers, and ensure compliance with fit and proper requirements. Registration must be completed by 17 September 2022, and an annual return certifying compliance is required. Non-compliance may result in administrative sanctions or penalties.

We have set out the key features of the Regulations below. Importantly, the Regulations were largely adopted in their draft form, which we have discussed in an earlier alert. For more information on the implications of the Act and the Regulations (then referred to as the ‘Draft Regulations’), please see our previous alert and podcast on this topic.

Application requirements and process

In order to apply for a licence, digital lenders are advised that they will need to complete an application form as prescribed in the Regulations and, among other things, provide the CBK with:

  • a description of the ICT system to be used in the digital lender’s operations and an independent assurance on the systems;
  • a description of the delivery channels or platforms to be used, as well as a description of the terms and conditions of the credit products and services to be provided;
  • an anti-money laundering and combating the financing of terrorism policy and procedure;
  • a data protection policy and procedure;
  • a consumer redress mechanisms policy and procedure; and
  • a description and evidence of the sources of funds to be invested in the digital lender, to name a few.

Notably, the Regulations depart from the position in the draft regulations which proposed to make registration as a data controller or processor under the Data Protection Act, 2019 (DPA) a prerequisite to this application for a digital lending licence. As we previously explained, this requirement was foreseeably difficult, because at the time, the DPA regulations that were to govern the registration of a data controller or processer were yet to be published. As at the date of this alert, the DPA regulations have been enacted; although, the Regulations no longer require this as a precondition to a digital lenders licence. Instead, digital lenders are only required to provide the CBK with a data protection policy and procedure. Digital lenders are therefore advised that they do not need to register with the Office of the Data Commissioner prior to obtaining a licence with the CBK.

Once an application is submitted, the Regulations provide that the CBK will consider the history of the digital lender; the professional and moral suitability of the persons proposed to manage or control the digital lender; the source and evidence of funds to be invested by or in the digital lender; as well as the public interest element in licensing the applicant digital lender. This requirement to consider the public interest creates a new and interesting aspect of the licensing process. It will be interesting to observe how the public interest is considered during the application process and how much value is ascribed to matters of public interest. This approach does however align itself with the CBK’s position set forth in their press release, which stated that the Regulations were enacted to “address the concerns raised by the public”.

Furthermore, the Regulations provide that upon considering the factors outlined above, the CBK will within 60 days, either grant the licence, grant the licence subject to conditions, or reject the application. Thereafter, the CBK will within 30 days publish the names of the digital lender on the CBK website. 

Notification requirements

The Regulations provide that a digital lender must notify the CBK of its significant shareholders, director, chief executive officer (CEO) or senior officer, to obtain certification that these persons are fit and proper to perform the intended function. Digital lenders are advised that they will need to fill in the prescribed forms in relation to each of these persons and submit them to the CBK for approval.

The Regulations further grant the CBK the power to assess the suitability of these individuals from time to time, where it considers it necessary. Therefore, digital lenders should ensure that the fit and proper requirements set forth in the Act are met at all times. Any changes in the significant shareholding, board or management structure or any appointment of a new director or senior officer will warrant notification to the CBK, at least 30 days prior to the effective date of the intended change or appointment.

Timelines, fees and returns

According to the press release, all digital lenders must be registered with the CBK by 17 September 2022, failure to which they must cease operations.

Furthermore, the Regulations have confirmed that the fee for a licence is five thousand shillings (Kshs 5,000 approximately USD 45), whilst the annual fee is twenty thousand shillings (Kshs 20,000 approximately USD 175).

In relation to returns, the Regulations require digital lenders to submit an annual return to the CBK certifying that it has complied with the provisions of the Act and the Regulations. Failure to which, the CBK is entitled to impose a number of administrative sanctions, including a monetary penalty not exceeding five hundred thousand shillings (Kshs 500,000 approximately USD 4,500) on the digital lender, its directors, officers or employee’s responsible for the non-compliance. Other sanctions include suspension or disqualification from office of the non-compliant director, officer, or employee, as well as more frequent CBK inspections into the digital lender’s operation, to name a few. The Regulations further provide that the CBK will determine the administrative sanctions on a case-by-case basis, meaning that different sanctions may be imposed for different violations and against different digital lenders.


The Regulations seek to address concerns raised by the public over the last few years in response to the significant growth of digital lending in Kenya. The Act was established to provide oversight and provide for consumer protection, credit information sharing and outline the obligations of digital lenders in Kenya. The enactment of the Regulations now give force to the Act and have made the provisions of the Act operational and enforceable.

Existing digital lenders, and those who intend to enter the market are advised to begin the application process to ensure that they meet the 17 September 2022 deadline.

The information and material published on this website is provided for general purposes only and does not constitute legal advice. We make every effort to ensure that the content is updated regularly and to offer the most current and accurate information. Please consult one of our lawyers on any specific legal problem or matter. We accept no responsibility for any loss or damage, whether direct or consequential, which may arise from reliance on the information contained in these pages. Please refer to our full terms and conditions. Copyright © 2024 Cliffe Dekker Hofmeyr. All rights reserved. For permission to reproduce an article or publication, please contact us cliffedekkerhofmeyr@cdhlegal.com.