Fintech & digital payments rules in Kenya (2026)

CBK released draft regulations to operationalise the 2024 Business Laws (Amendment) Act, setting out licensing, governance, pricing transparency, and consumer protection requirements for the newly defined NDTCP category; public comments were invited before finalisation.

The Act amended the CBK Act to replace 'digital credit business' with 'non-deposit taking credit business', extending CBK licensing authority beyond app-based lenders to embedded finance platforms, payroll intermediaries, and cross-border remittance apps — the most significant expansion of CBK's fintech perimeter since 2021.

The National Treasury & Economic Planning issued Terms of Reference for a consultancy to design a comprehensive consumer protection framework for digital payments, signalling a policy gap identified after the 2022 DCP Regulations focused narrowly on digital credit rather than the broader payments ecosystem.

CBK introduced a single interoperable QR code standard enabling consumers to pay any merchant across all Payment Service Providers and mobile network operators, a concrete deliverable of the National Payments Strategy 2022–2025 and a step toward a unified digital payments acceptance infrastructure.

CBK directed all mobile money operators to enable seamless real-time inter-network transfers for both person-to-person and merchant payments, ending the siloed ecosystem and implementing a key plank of the just-published National Payments Strategy.

Legal Notice No. 46 established licensing, governance, AML, Data Protection Act compliance, and ethical debt-collection requirements for digital credit providers; the ~10 million Kenyans using unregulated app-based loans gained formal regulatory protection, with a 6-month deadline for existing providers to apply or exit.

Assented to on 7 December and effective 23 December 2021, the Act inserted new powers into the CBK Act enabling it to license, supervise, and sanction digital credit providers for the first time, closing a years-long regulatory gap that had allowed predatory app-based lenders to charge triple-digit effective rates with no oversight.

Kenya's first comprehensive data protection statute imposed consent, purpose-limitation, and data-security requirements on any entity processing personal data, including fintechs; it was subsequently cross-referenced as a mandatory compliance obligation in the 2022 Digital Credit Providers Regulations.

Legal Notice 109 operationalised the NPS Act 2011 by creating four PSP categories (Electronic Retail, Small E-Money Issuer, E-Money Issuer, Designated Payment Instrument Issuer) with tiered capital requirements (KSh 1 M–50 M), formal AML obligations, and a structured CBK authorisation procedure — giving M-Pesa and competitors a defined legal home for the first time.

Kenya's foundational payments statute granted CBK statutory authority to license, regulate, and supervise all payment systems and payment service providers including mobile money operators, replacing the ad hoc no-objection letter approach with a formal legal framework and establishing the National Payments System Council.

Safaricom launched M-Pesa on 6 March 2007 under a CBK letter of no objection rather than a banking licence — a deliberate 'test and learn' approach that exempted the service from full KYC rules while requiring customer funds to be held in trust at regulated banks, pioneering the mobile money model later replicated worldwide.