The Central Bank of Kenya (CBK) has dropped a regulatory bombshell. It’s bold, sweeping, and could change the face of lending in Kenya’s fintech ecosystem. Are you ready?
A New Era for Kenya’s Non-Deposit-Taking Lenders
Kenya’s fintech frontier has exploded and the Central Bank of Kenya (CBK) is moving to shore up the perimeter. The CBK first launched regulations for Digital Credit Providers in 2022 to rein in sky-high interest rates, abusive debt collection and data privacy abuses by online lender. Now, just three years later, it’s back with a broader vision: draft Non-Deposit-Taking Credit Provider (NDTCP) Regulations, 2025 that sweep all lenders outside the traditional banking system into a tighter rulebook. In plain terms, if your startup or fund makes loans but doesn’t take deposits (think loan apps, buy-now-pay-later platforms, micro-lenders, peer to peer lenders and the like), these rules are coming at you.
The draft regulations aim to strengthen oversight and raise standards across Kenya’s fast-evolving credit market. They go well beyond the 2022 rules by imposing mandatory governance, risk management, consumer safeguards and even anti-money-laundering measures on non-bank lenders. The CBK has opened a public comment window (until September 5, 2025) and the stakes are high. This framework could reshape how innovation, compliance and capital flow in Kenya’s fintech space.
Key Provisions of The Draft Regulations
- Licensing & Registration
Kenya’s lenders are split into two camps by size. Entities with initial capital over Kshs. 20 million must apply for a full licence, complete with detailed disclosures on ownership, capital sources, governance, risk management and more. Smaller lenders under Kshs. 20 million can register with the CBK with a lighter but still robust set of requirements.
- Consumer Protection
Consumer protection is at the heart of these draft rules. NDTCPs must:
- Give borrowers clear, accurate loan information upfront, no hidden fees, no surprises.
- Provide receipts, statements of account, and repayment schedules in accessible formats.
- Establish complaints-handling systems: acknowledge in 7 days, resolve in 30 days.
- Avoid harassment, intimidation, or reckless lending during debt collection.
- And here’s one for guarantors: you only get roped in if you gave explicit consent, and lenders must exhaust all other options before knocking on your door.
- Risk Management
Every NDTCP must develop a risk management framework tailored to its business. That includes credit risk, operational risk, compliance risk, reputation risk, IT risk, and even liquidity risk.
- Data Protection
Remember the data scandals that haunted early loan apps? Those days are numbered. Under these rules, NDTCPs must strictly comply with the Data Protection Act. Consumers must be able to opt out of marketing, and lenders can’t misuse personal information.
- Anti-money Laundering and Combating the Financing of Terrorism (AML &CFT)
CBK is serious about keeping illicit funds out of the system. NDTCPs must show evidence of their funding sources, conduct customer due diligence (yes, proper KYC), verify identities especially in non-face-to-face transactions and report suspicious transactions under Kenya’s anti-money laundering and terrorism financing laws. Fail to comply, and you could face penalties, suspension, or outright revocation.
- Enforcement and sanctions
CBK can slap non-compliant lenders with fines, suspend or revoke their licenses, bar certain activities or even disqualify officials. Any suspended or banned lender will be publicly gazetted. The rules ensure due process (notice and chance to respond), but in serious cases CBK won’t hesitate to take action Impose fines and penalties.
What This Means for FinTechs, Innovators, and Investors
This isn’t just about rules. it’s about reshaping strategy.
- Compliance Will Cost You but Open Doors Too
For fintech founders, compliance will mean new costs: setting up complaints desks, hiring compliance officers, implementing risk systems. But it also means greater credibility. Customers will trust you. Investors will feel safer backing you.
- Consumer Trust
In a market where reputation can make or break a fintech, being a compliant, transparent, borrower-friendly lender could be your best marketing tool. Early adopters of these standards may outshine competitors who drag their feet.
- Opportunity in the Order
These regulations may feel like a straitjacket, but they also bring clarity. Peer to Peer lending, Buy Now Pay Later products, and microloans now have a framework. By formalizing the rules, CBK is giving innovators a sandbox with guardrails to build in.
Conclusion
The CBK’s Draft NDTCP Regulations, 2025, are not just about law, they’re about the future of Kenya’s credit market. They’re about building a system that’s fair, transparent, and resilient, while leaving room for innovation to flourish. For digital lenders and fintech founders, this is your call to evolve. For investors, this is your cue to back the players who can balance creativity with compliance. For consumers it’s a promise of fairer, safer credit.
Kenya’s credit market is entering a new chapter. The question is will you be ready when the rulebook becomes law?