CBK Non-Deposit Taking Credit Providers Regulations 2026: Licensing and Transition Guide for Digital Lenders in Kenya
What licensed DCPs, logbook lenders, BNPL providers and other credit businesses must do to comply with the new CBK regime, including the KES 20 million capital threshold, fees and the March 2027 deadline.
Every digital lender and credit-only business in Kenya now needs a CBK licence or registration. The Central Bank of Kenya (CBK) has published the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026 (Legal Notice No. 191 of 2026, Kenya Gazette Supplement No. 234 of 29 September 2026). The Regulations replace the Digital Credit Providers Regulations, 2022. They bring a much wider range of lenders under CBK supervision: anyone extending credit from their own funds, digitally or otherwise.
For digital credit providers (DCPs) already licensed by CBK, the change is mainly one of compliance: their existing licences carry over, but the rules they must meet are now broader and more detailed. For logbook lenders, asset financiers, buy-now-pay-later and stock-now-pay-later providers, pay-as-you-go operators, peer-to-peer platforms and other credit-only businesses that have operated outside CBK oversight, it means a licensing deadline. Below we set out what the new regime requires and how each category of lender should prepare.
Figure 1: Which transition path applies to you?
Who Needs a CBK Licence Under the New Regulations?
The Regulations apply to any person carrying on non-deposit taking credit business that is not regulated under another written law. This includes granting loans (digitally or otherwise), asset financing, buy-now-pay-later and stock-now-pay-later arrangements, credit guarantees, pay-as-you-go arrangements and peer-to-peer lending. Banks, microfinance banks, Saccos, co-operatives, credit guarantee companies, hire-purchase arrangements and credit that is merely incidental to selling goods or services are excluded.
Under regulation 5, no person may carry on, or present themselves as carrying on, non-deposit taking credit business without a CBK licence or certificate of registration.
CBK Licence vs Registration: Which Route Applies to Your Business?
The Regulations set up a two-tier framework:
| Licence | Registration | |
|---|---|---|
| Who | Initial capital of KES 20 million or more | Smaller providers below the KES 20m threshold |
| Application form | Form 1 | Form 2 |
| Application fee | KES 100,000 (non-refundable) | KES 100,000 (non-refundable) |
| Fee on grant and annually | KES 500,000 | KES 250,000 |
| Fit-and-proper certification | Required for significant shareholders, directors, CEO and senior officers | As CBK may specify case by case |
| Conversion | N/A | Must convert to a licence once capital, borrowings or loan book exceeds KES 20m |
| CBK decision | Within 60 days of submission | On receipt of complete documentation |
Figure 2: Regulatory fees under the Third Schedule
A registered provider must apply to convert to a licence once its capital, borrowings or loan book exceeds KES 20 million. CBK can also direct it to convert after rapid growth. Understating capital to qualify for registration attracts a statutory penalty and may lead to revocation, so the choice of route needs careful structuring at the start.
What Existing Digital Credit Providers (DCPs) Must Do
Under regulation 96, DCPs licensed under the 2022 Regulations are deemed to be licensed under the new regime and may continue to operate. Their accrued rights and liabilities carry over, and applications pending at commencement will be processed under the new framework.
Being deemed licensed does not mean nothing changes. The Regulations add or tighten several obligations that existing DCPs should review against their current operations:
| Area | What the Regulations require | What DCPs should do |
|---|---|---|
| Products and pricing | Prior CBK approval for new products, product changes, interest rates and pricing parameters; 30 days’ notice to customers (regs 26, 55) | Inventory products; set up an approval workflow |
| Pricing model | Documented model covering cost of funds, operating costs, risk premium and fees; APR and total cost of credit in all advertising (regs 51, 59) | Document the model; audit marketing materials |
| Data consent | Standalone, express, withdrawable consent form; a privacy notice alone is not enough (reg 58) | Redesign onboarding consent flows |
| Artificial intelligence | Explain automated decisions, disclose AI interactions, keep human oversight, assess bias (reg 60) | Adopt an AI governance policy |
| Credit policy and NPLs | 29 minimum credit policy items; interest on non-performing loans capped at principal (regs 25, 29) | Update the credit policy; check system interest caps |
| Debt collection | No access to contact lists, no shaming, no calls outside working hours (reg 30) | Retrain staff and collectors; update agency contracts |
| Accessibility | Premises and digital platforms accessible to persons with disabilities (reg 37) | Accessibility audit and policy |
| Reporting | Monthly, quarterly and annual returns; compliance certification by 31 Dec; 24-hour incident reports (reg 66) | Build a regulatory returns calendar |
| Governance | Fit-and-proper certification; prior approval for share transfers of 10% or more (regs 14, 22) | Review cap table and board; update Articles |
We recommend that every DCP carry out a structured gap analysis now, update its policies and get board approval for them, and plan for its first annual fee and compliance return under the new regime.
Deadline for Logbook Lenders, BNPL and Other Credit Providers to Apply
Lenders that were carrying on non-deposit taking credit business outside CBK regulation when the Regulations commenced must apply for a licence or registration within six months of publication, that is, by approximately 29 March 2027. Those who apply on time may continue operating while CBK considers their application, subject to the Regulations and any conditions CBK imposes. Those who do not apply in time risk having to stop lending.
Figure 3: Key dates in the transition
CBK licence application requirements
The application is substantial. Among other things it requires:
- Certified corporate documents, details of beneficial ownership, and a registered physical office in Kenya.
- Evidence of capital and its source, sworn declarations that the funds are not proceeds of crime, and notice to CBK before capital is injected.
- Fit-and-proper forms for directors, senior officers and significant shareholders, each supported by a certificate of good conduct, a tax compliance certificate and a credit reference bureau report.
- A Data Protection Act registration certificate from the Office of the Data Protection Commissioner.
- Board-approved policies covering credit, pricing, consumer protection, AML/CFT, data protection, ICT security, corporate governance and business continuity, plus a code of conduct.
- Product terms, loan agreement templates, details of delivery channels and technology, and draft agreements with outsourcing and channel providers.
CBK aims to decide licence applications within 60 days of submission. If an applicant fails to respond to CBK’s requests for further information within three months, CBK may stop processing the application. Several of these items, especially fit-and-proper documentation and ODPC registration, take weeks to put together, so lenders should start now.
Starting a New Lending Business in Kenya
Promoters setting up a new credit business must first get CBK approval for the company name, submitting three proposed names and a business brief. They then need a letter of no objection from the Kenya Industrial Property Institute, must incorporate within three months of CBK’s name approval, and must apply within six months of incorporation. Once licensed, the business must commence within twelve months. Shareholders may not transfer 50% or more of the shares within the first year of operation.
Key Deadlines Under the CBK Credit Provider Regulations
| Milestone | Deadline | Regulation |
|---|---|---|
| Incorporate after CBK name approval | Within 3 months | 4(9) |
| Apply after incorporation | Within 6 months | 4(9) |
| Existing unregulated lenders to apply | By ~29 March 2027 | 96(1) |
| CBK decision on licence application | Within 60 days of submission | 7(2) |
| Respond to CBK information requests | Before 3 months lapse | 8 |
| Commence business after licensing | Within 12 months | 21(1)(r) |
| Notify CBK of new channels, outsourcing, premises or management changes | 30 days in advance | 15, 16, 27, 31 |
| Report fraud or cyber incidents | Within 24 hours | 66(8) |
| Annual fee and compliance return | By 31 December each year | 7(4), 66(7) |
| Audited financial statements | Within 3 months of year-end | 67 |
Common Pitfalls in CBK Licensing Applications
From our review of the Regulations, the areas most likely to cause delays or regulatory exposure are:
- Business models that include features now prohibited, such as registration or membership fees, cash collateral, savings or goal accounts, or payment and fund-transfer services.
- Shareholders who also hold a similar position in another credit provider, or links to deposit-taking institutions.
- Source-of-funds documentation that does not trace capital clearly back to its origin.
- Policies taken from templates that do not reflect how the business actually operates or have not been formally approved by the board.
- Outsourcing contracts that do not give CBK the required rights of access and oversight.
Some provisions of the Regulations are open to interpretation, including how certain cross-references, fee mechanics and timelines apply. These should be clarified with CBK early in the process.
Frequently Asked Questions
When do the CBK Non-Deposit Taking Credit Providers Regulations 2026 take effect?
The Regulations were made on 4 September 2026 and published as Legal Notice No. 191 of 2026 on 29 September 2026. They revoke the Digital Credit Providers Regulations, 2022.
Do licensed digital credit providers need to apply for a new CBK licence?
No. DCPs licensed under the 2022 Regulations are deemed licensed under the new Regulations (regulation 96). They must, however, comply with all the new requirements, including product and pricing approvals, consent rules and expanded reporting.
What is the minimum capital for a CBK non-deposit taking credit provider licence?
An applicant for a licence must have initial capital of at least KES 20 million. Lenders below that threshold apply for registration instead, and must convert to a licence once capital, borrowings or loan book exceeds KES 20 million.
How long does CBK take to approve a credit provider licence?
CBK may grant a licence within 60 days of submission of an application. Incomplete applications and slow responses to CBK queries delay approval, and CBK may stop processing an application if the applicant does not respond for three months.
What are the CBK licence fees for credit providers?
The application fee is KES 100,000 (non-refundable). A licence costs KES 500,000 on grant and every year after that; a certificate of registration costs KES 250,000 on grant and every year after that. Annual fees are due by 31 December.
Can an existing lender keep operating while its application is pending?
Yes. A lender that was carrying on non-deposit taking credit business when the Regulations commenced may continue operating while CBK considers its application, provided it applies within six months of publication (by about 29 March 2027).
Are logbook lenders, BNPL and asset financiers covered?
Yes, unless their business is regulated under another written law. The Regulations expressly cover loans, asset financing, buy-now-pay-later, stock-now-pay-later, pay-as-you-go, credit guarantees and peer-to-peer lending. Hire purchase and credit merely incidental to the sale of goods are excluded.
Can a credit provider charge membership fees or take cash as security?
No. Regulation 18 prohibits non-deposit taking credit providers from taking cash as security for loans, collecting registration or membership fees from loan applicants, offering savings accounts and providing payment services, among other activities.
How MjM Advocates Can Help with CBK Licensing
MjM Advocates is a Nairobi law firm advising digital lenders, fintechs and investors on CBK licensing, financial services regulation, corporate structuring and compliance. We can support you at every stage of the transition:
- Regulatory scoping and structuring: confirming whether your business falls within the Regulations, advising on licence or registration, and screening your model and products for prohibited features.
- Gap analysis for existing DCPs: reviewing your policies, products, pricing, consent mechanisms and collection practices against the new requirements, with a prioritised remediation plan.
- End-to-end licensing: name approval, incorporation, beneficial ownership filings, fit-and-proper documentation, source-of-funds evidence, Forms 1 to 4, and liaison with CBK through to grant.
- Policy drafting: credit, pricing, consumer protection, AML/CFT, data protection, ICT, governance, business continuity and code of conduct, all drafted to fit your actual operations.
- Customer documentation: loan agreements, key information documents, consent forms, guarantor documents and CRB notices.
- Data protection compliance: ODPC registration and alignment with the Data Protection Act.
- Ongoing compliance support: regulatory returns calendars, approvals for product and pricing changes, notifications of shareholding and management changes, and advice on CBK enforcement or review proceedings.
Speak to a Financial Services Regulatory Lawyer in Nairobi
The transition window is short and CBK will expect complete, well-supported applications. If your business extends credit in Kenya, whether as an existing DCP or as a lender coming under CBK supervision for the first time, we encourage you to contact us for an initial consultation.
MjM Advocates, 6th Floor, Rainbow Tower, Muthithi Road, Westlands, Nairobi | Tel: 0712 122528 | Email: info@mjmadvocates.com | www.mjmadvocates.com
This article is for general information only and does not constitute legal advice. Specific advice should be sought on the facts of each case.