Beyond Licensing: CBK's 2026 Non-Deposit Taking Credit Providers Regulations

Executive overview

The Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026, published as Legal Notice No. 191 on 29 September 2026, shall replace the narrower Digital Credit Providers Regulations, 2022 and introduce a wider supervisory framework for non-deposit-taking credit businesses. The Regulations reach far and beyond mobile applications and address conventional credit, digital loans, buy-now-pay-later, stock-now-pay-later, pay-as-you-go and approved peer-to-peer lending models, subject to specified exclusions.

For the existing Digital Credit Providers (DCPs), continuity of licensing status does not amount to continuity of compliance. This framework converts licensing into an ongoing institutional obligation covering board accountability, ownership, source of funds, product approval, pricing, consumer protection, data use, artificial intelligence, outsourcing, complaints, reporting and enforcement.

CBK’s May 2026 Regulatory Impact Statement identifies high loan costs, unethical debt collection, abuse of personal information and uncertainty over the earlier regulatory perimeter as concerns underlying the reform programme. Read together, the competition-law decision, repossession judgments and data-protection determinations examined in sections 6, 9 and 11 illustrate the recurring pricing, recovery, consent, marketing and disclosure problems that give substance to that policy rationale. This article therefore treats their subject matter as evidence of the need for stronger supervision-not as proof that CBK expressly relied on every decision when developing the Regulations.

1. A wider regulatory perimeter

“These Regulations shall apply to non-deposit taking credit business not regulated under any other written law.”

Regulation 3 establishes the perimeter. The framework applies to persons seeking to conduct non-deposit-taking credit business unless they are licensed or registered by the Bank(Central Bank of Kenya) or regulated under another written law. The definition of “loan” is deliberately broad and the Regulations separately recognise pay-as-you-go arrangements in which access to an asset may be restricted, deactivated or repossessed following non-payment.

Key exclusions under the regulations

• Institutions licensed under the Banking Act and regulated microfinance banks.
• Registered co-operative societies and licensed SACCOs.
• Regulated credit guarantee, lease-finance and hire-purchase arrangements.
• Credit that is merely incidental to the sale of goods or services.
• Credit business regulated under another written law.

Why legal classification matters

Regulatory status turns on commercial substance, not branding. A retailer that occasionally allows instalment payment may fall within the incidental-credit exclusion. A business that derives material revenue from finance charges, penalties, deactivation rights or repossession may instead be carrying on regulated credit business, even if it describes itself as a technology, subscription or asset-access company. The legal classification matters for various reasons:

• How and when the provider earns revenue;
• Whether credit is central or incidental to the principal business;
• When ownership and risk pass to the customer
• The provider’s rights after default, including restriction, deactivation and repossession;
• The roles of the retailer, platform, lender and financier;and
• Whether another regulator has jurisdiction.

2. Licensing, registration and the KES 20 million threshold

“A person who seeks to establish a non-deposit taking credit business in Kenya and whose initial capital is not less than twenty million shillings shall apply to the Bank for a licence…”

Regulations 5 and 6 prohibit unlicensed or unregistered business and require a person with initial capital of at least KES 20 million to apply for a licence. The application is an institutional-readiness exercise. It requires corporate and beneficial-ownership information, evidence and source of capital, products and terms, delivery channels, technology, consumer-protection measures, credit and pricing policies, AML/CFT controls, data-protection and cybersecurity policies, governance documents, fit-and-proper materials, business-continuity arrangements and audited financial information where applicable. Board approval of the prescribed policies and manuals is required.

Regulation 9 provides a registration route for a person who does not meet the licensing conditions. Registration is not a light-touch exemption. Registered providers remain subject to substantive operational and conduct requirements.

Conversion to licensing

Under Regulation 11, a registered provider must apply for a licence if its capital, borrowings or loan book exceeds KES 20 million. The Bank may also direct conversion where amounts were understated or the business has expanded rapidly. A provider should therefore monitor these indicators monthly and begin conversion preparations before the threshold is crossed.

3. Application, licence and registration charges

The Third Schedule and Regulations 6, 7, 9 and 10 create direct entry and recurring costs. The application fee is non-refundable. Annual fees are now due on or before 31 December, and late payment may lead to increased charges and ultimately revocation.

A successful applicant should ordinarily budget for an initial direct regulatory charge of KES 600,000 for licensing or KES 350,000 for registration, excluding legal, audit, technology, cybersecurity and continuing compliance costs.

An apparent late-fee inconsistency

Regulations 7(5) and 10(5) refer to payment of double the annual fee where payment is made within three months after 31 December. The Third Schedule states a late penalty fee of KES 1 million. The provisions align for a licensed provider, but appear inconsistent for a registered provider because twice KES 250,000 is KES 500,000. Pending clarification, registered providers should avoid relying on the lower interpretation and pay before the deadline. Consequently, NDCTP’s have a pivotal role in diligently maintaining a compliance calendar round the clock.

The charge cannot be passed to borrowers as a registration fee

Regulation 18(1)(d) prohibits collecting any registration fees, membership fees and other fees determined by the Bank from loan applicants or borrowers. A provider cannot recoup regulatory charges by imposing a customer “registration”, “membership”, “activation” or "access fee" as a condition of obtaining credit. Any lawful customer charge must be justified, approved where required, and disclosed as part of the total cost of credit.

4. Transitional compliance

“A person who, at the commencement of these Regulations, was conducting non-deposit taking credit business which is not regulated under any other written law shall apply to the Bank for a licence or registration within six months of publication of these Regulations.”

Regulation 96 is the centrepiece of transition. Because the Regulations were published on 29 September 2026, the six-month period falls approximately on 29 March 2027, subject to the applicable computation-of-time rules and any guidance from the Bank.

Previously unregulated providers

Regulation 96(2) permits an applicant to continue conducting business pending determination, but only subject to the Central Bank of Kenya Act, the Regulations and any conditions issued by the Bank. This is not an unconditional grace period. A provider should align its operations while preparing and prosecuting the application.

Existing licensed DCPs

Regulations 96(3) and 96(4) preserve the position of a provider licensed under the 2022 Regulations and deem it licensed under the 2026 framework. This protects licence continuity, not obsolete products, contracts or practices. Regulation 96(5) preserves accrued rights and liabilities, while Regulation 96(6) requires pending applications to be processed under the new Parts II or III. Regulation 97 revokes the 2022 Regulations.

Transitional action plan

1. Classify every business line and product under Regulation 3;
2. Determine whether the provider is deemed licensed, requires licensing or registration, or must convert under Regulation 11;
3. Complete a regulation-by-regulation gap assessment and board-approved remediation plan;
4. Audit existing products, rates, fees, repayment structures and delivery channels;
5. Update board-approved governance, credit, pricing, data, AI, outsourcing, collections, complaints, cybersecurity and AML/CFT policies;
6. Review shareholders, directors and senior officers against Regulation 14 fit-and-proper requirements;
7. Update customer agreements, key information documents, consent forms, guarantor instruments and CRB notices;
8. Map and remediate third-party arrangements under Regulation 31;
9. Create a statutory approvals, notifications, returns and fee calendar;and
10. Submit early and maintain a response team for additional information requests.

5. Governance, fit-and-proper status and source of funds

Regulation 15 requires sound corporate governance grounded in ethics, integrity, legitimacy, risk management and legal compliance. The board must be proportionate to the provider’s size, complexity and risk profile, maintain effective separation from management and receive adequate information on operations and technology.

“Where a non-deposit taking credit provider is a subsidiary of a group of companies or non-operating holding company, the board of the non-deposit taking credit provider shall remain responsible for the corporate governance in the non-deposit taking credit provider.”

Group control does not displace entity-level accountability. A Kenyan board must test group pricing, technology, data, collection and outsourcing arrangements against Kenyan law and document its challenge and oversight. Regulation 14 subjects significant shareholders, directors, the chief executives and senior officers to continuing fit-and-proper scrutiny. Regulation 62 requires evidence of source of funds and pre-investment notification of additional capital.

6. Product approval, responsible lending and pricing

Kenya Law’s core legal resources include case law, the Laws of Kenya, the Kenya Gazette and legal publications.

“A non-deposit taking credit provider shall not introduce a new non-deposit taking credit product to the market or vary the features of an existing product, including the interest rates, without the prior written approval of the Bank.”

Regulations 26 and 55 restrict both new products and variations. Providers must justify proposed changes, obtain prior written approval and give customers at least 30 days’ notice. Contractual changes require customer acceptance. Product, legal, compliance and technology teams should therefore operate a formal product-governance process before development or launch.

Credit appraisal

Regulation 28 requires reasonable assessment of repayment ability, consideration of credit risk, adherence to the board-approved credit policy and avoidance of reckless lending. Rejected applicants must be informed promptly and given reasons. A provider may breach the rule by disregarding its own policy, even where the policy itself appears compliant.

Pricing and total cost

Regulation 59 requires an identifiable pricing model covering cost of funds, cost of capital, operating costs, shareholder return, risk premium, other charges, customer risk, credit-reference information, non-performance criteria and annual percentage rate(APR). Regulations 51 and 52 require transparent advertising of the APR and total cost of credit.

PRACTICAL EXAMPLE A product advertised at “10%” may be misleading if processing, platform, insurance or account-management fees reduce the amount disbursed or materially increase repayment. The app screen, advertisement, pricing model, executed agreement, repayment schedule and account ledger should reconcile.

Pricing transparency carries independent enforcement risk

In its decision issued on 4 October 2024, the Competition Authority of Kenya (CAK) ordered Mogo Auto Limited to pay a pecuniary penalty of KES 10,851,473.20 for false and misleading representation and unconscionable conduct contrary to the Competition Act, Cap. 504. Separately, it directed refunds totaling KES 344,939 to three loan customers for excess repayment charges and differences in the dollar exchange rate applied at loan issuance. The penalty payable to the Authority and the customer refunds are distinct remedies; neither should be presented as a civil damages award or a CBK penalty.

The investigation followed complaints from four customers lodged between 6 May 2023 and 11 April 2024. One complainant described a KES 2.1 million facility, repayable over 60 months at a stated 2.6% flat interest rate, and alleged that the basis changed to reducing balance and that interest was calculated in US dollars despite disbursement in Kenyan shillings. A second described a KES 300,000 facility and a quoted settlement balance of KES 392,000 after 20 months of repayments, with the amount repayable computed in dollars. A third described KES 310,000 vehicle financing and alleged that dollar figures initially explained as being for record-keeping were subsequently used to calculate instalments payable in shillings. These are the customer allegations recounted in the decision, not separate judicial findings on each account.

Beyond the monetary orders, CAK directed Mogo to refrain from misrepresenting facts and engaging in unconscionable conduct, amicably resolve all pending complaints before the Authority, and resolve future complaints expeditiously. The practical lesson is that pricing governance must cover the actual calculation method, currency denomination, exchange-rate mechanism and customer-facing explanation-not merely the headline interest rate. Providers should reconcile quotations, signed terms, repayment schedules, account statements and settlement figures, and retain evidence of how material terms and changes were explained and accepted.

The CAK decision against Mogo Auto Limited provides a concrete example of the pricing-transparency and customer-redress problems that support the policy case for the product, pricing, disclosure and complaints controls discussed in sections 6-8. CBK’s Regulatory Impact Statement identifies high loan costs and continuing weaknesses in the earlier framework as part of the background to reform. The connection drawn here is analytical: the material reviewed does not establish that CBK cited this particular decision as a reason for making the Regulations. The decision remains a separate competition-law enforcement action, not a retrospective finding under the 2026 Regulations or a universal prohibition on dollar-denominated lending. Its subsequent payment, satisfaction and any appeal or stay should be checked before publication.

7. Charges, non-performing loans and repayment allocation

Regulation 30 prohibits recovery of charges not disclosed in the customer contract and empowers the Bank to direct refunds of excess, contractually unauthorised or undisclosed amounts. Regulation 29 limits recovery on a non-performing loan to the principal outstanding when it became non-performing, contractual interest not exceeding that principal and reasonable recovery expenses. A lender should not attempt to relabel interest as a rollover, maintenance, extension or collection charge.

Regulation 56 requires payments to be credited when received and allocated first to principal, then fees and charges, and finally interest. Borrowers may repay early without notice or penalty and should not be charged interest for the unexpired period after full early repayment.

8. Consumer protection, complaints and guarantors

Part V moves consumer protection into the centre of supervision. Providers must use fair, clear and transparent information; issue executed agreements and repayment schedules; maintain key information documents; acknowledge transactions; provide statements; correct errors; and explain information orally where the consumer cannot understand the written form.

Customer complaints timelines

Regulation 40 requires accessible redress, prompt resolution where possible, acknowledgement within seven days where immediate resolution is not practicable, written confirmation where an oral complaint remains unresolved after 48 hours, and resolution within 30 days where immediate resolution is impossible. Complaints should be analysed for recurring root causes and reported to management and the board.

Guarantors prior and continuous consent

Regulations 39 and 42 require genuine guarantor consent, periodic information on loan performance, exhaustion of non-judicial recovery measures against the borrower, and at least 14 days’ notice of default before a repayment demand. A telephone number entered by a borrower does not, without more, establish an enforceable guarantee.

9. Debt recovery and prohibited conduct

Regulation 30 prohibits threats, violence, humiliation, abusive language, debt shaming, access to a customer’s phonebook for recovery messages, publication of personal information, unauthorised contact with references or contacts, harassment, calls outside working hours and improper repossession. Regulation 43 limits recovery expenses to those that are absolutely necessary and requires a detailed breakdown. Regulation 44 requires customers to be told who will collect an outsourced debt and how collection may occur.

Adverse repossession & legal exposure beyond the loan contract

The following judicial decisions complement the data-protection determinations in section 11 and illustrate the enforcement-procedure risks that make stronger debt-recovery safeguards necessary. Their common policy relevance is that a contractual right to recover a debt does not dispense with lawful notice, repossession and redress procedures. That relevance aligns with CBK’s stated concern about unethical debt collection. They are evidence supporting this article’s explanation of the need for reform, rather than verified case-specific reasons recorded by CBK. Chronology is important: Muhinji (December 2025) and Luambo (August 2026) postdate the August 2025 consultation draft; Luambo also postdates the May 2026 Regulatory Impact Statement. They cannot explain the original development of those earlier documents, although they illustrate the continuing relevance of recovery safeguards. None establishes a retrospective breach of the 2026 Regulations.

Mogo Auto Limited v Otianga: restitution despite partial success on appeal. In Mogo Auto Limited v Otianga [2024] KEHC 13055 (KLR), decided on 22 October 2024, the High Court allowed the lender’s appeal only in part. It overturned the trial court’s application of the in duplum rule, its finding that the interest was illegal and unconscionable, and consequently set aside the permanent injunction, finding that the Respondent had come to court with unclean hands and was not entitled to an equitable remedy. Nevertheless, because service of notice before repossession had not been proved, the Court set aside the repossession and ordered restitution of the vehicle. Further repossession was permissible only following lawful procedure upon default. Each party was to bear its own costs, including the auctioneer’s repossession costs. This is a lender loss on enforcement procedure, not authority that the lender lost every issue or that its interest charges were held unlawful on appeal.

Luambo v Mogo Auto Ltd & 4 others: damages for the manner of repossession

In Luambo v Mogo Auto Ltd & 4 others [2026] KEMC 829 (KLR), decided on 26 August 2026, the Magistrate’s Court declared the manner of repossession unlawful and entered judgment against the first and second defendants jointly and severally for KES 200,000 general damages, interest on that award from judgment, and costs. No special damages were awarded, and the claims against the remaining three defendants were dismissed. The exposure is therefore not limited to returning an asset: unlawful recovery can also generate damages, interest and litigation costs. The award is a civil remedy, not a CBK administrative penalty.

Muhinji v Mogo Auto Limited: an adverse appellate outcome requiring careful treatment

In Muhinji v Mogo Auto Limited [2025] KEHC 18928 (KLR), decided on 19 December 2025, the published record identifies the borrower’s appeal as allowed. The dispute concerned repossession and the adequacy of notice under sections 66 and 67 of the Movable Property Security Rights Act. The trial court had accepted a “Notice of Suspension” and dismissed the borrower’s suit. The borrower had claimed KES 150,000 for loss of use and KES 510,000 for the vehicle’s value. Those figures are pleaded claims, not verified awards. The available extract does not establish the appellate court’s precise reasoning or final relief; those matters should be confirmed from the complete judgment before this case is used for a more specific proposition.

Notice requirements and practical consequences for providers

The reasoning in Mogo Auto Limited v Ochola [2023] KEHC 17527 (KLR), decided on 4 May 2023, additionally criticised a 24-hour notice purportedly issued under section 67 of the Movable Property Security Rights Act as failing to afford a meaningful opportunity to remedy default. It also addressed repossession without notice and valuation. The available publication contains inconsistent outcome signals, so this article relies only on that identified reasoning and does not classify the appeal’s final disposition as a verified lender loss. The Act supplies the separate statutory framework for enforcement of security over movable property. Its applicability, the required notice and the permissible enforcement route must be checked for the particular transaction; the decisions should not be converted into a universal notice period for all credit products.

Validate before enforcement. Confirm the applicable security regime, contractual default, reconciled balance, content of the notice, method and proof of service, and expiry of the relevant remedy period before instructing repossession.

Control the recovery chain. Retain the instruction, notices, service evidence, asset-condition record and any required valuation and sale records. Check the authority and procedures of the auctioneer or recovery agent. These controls complement the outsourcing accountability discussed in section 10.

Budget for more than an unpaid balance. The verified outcomes above demonstrate exposure to restitution, damages, interest and costs even where a lender asserts an underlying debt. Defective recovery can delay realisation of security without necessarily extinguishing the debt.

Keep civil and regulatory liability distinct. These cases illustrate why enforceable recovery standards matter. For providers within the regulatory perimeter, the same operational practice may separately require assessment against the recovery and outsourcing provisions discussed in sections 9 and 10 and the enforcement provisions in section 14. A civil judgment is not automatically a regulatory breach, penalty or ground for Licence revocation.

10. Third-party service providers: accountability follows the provider

Regulation 2 defines a third-party service provider broadly enough to include group companies, unrelated Kenyan entities and offshore vendors performing material outsourced services. Outsourcing within a corporate group is therefore not outside the regulatory perimeter.

Reserved functions for third parties

“A non-deposit taking credit provider may outsource some of its material services … but such services shall not include- (a) the final decision to grant loans; (b) management and control …; (c) decision-making by the board; (d) determination of compliance …; and (e) management of the loan portfolio.”

Regulation 31 permits support services but preserves core control inside the regulated entity. A scoring vendor may generate risk outputs, but the provider must retain accountable final decision-making. External counsel may advise on compliance, but legal accountability remains with the provider and its board.

Liability and notification

“Where an outsourcing arrangement has been entered into, the non-deposit taking credit provider shall remain liable for all acts and omissions of the third-party service provider.”

Regulation 31(3) requires at least 30 days’ notice to the Bank before a material outsourcing arrangement, together with information on the service provider, its ownership and leadership, business record and the proposed service. Procurement processes must include a legal materiality assessment before contract signature or activation.

Contractual and inspection requirements

The outsourcing contract must protect customer information, require ethical service and regulatory compliance, and expressly preserve the Bank’s rights of oversight and access to premises, books, records, systems and employees. Regulation 66 permits inspection of the provider, its agents and outsourced service providers. Standard vendor confidentiality clauses cannot defeat supervisory access.

Critical technology providers

Regulation 31 expressly includes critical third-party technology providers whose failure could impair viability, critical operations or legal compliance. Cloud platforms, loan-management systems, scoring engines, identity services, payment integrations and cybersecurity vendors may be material even where their fees are below 5% of costs.

Third-party control checklist

11. Data protection and customer consent

Regulations 32, 53 and 58 limit collection to legitimate credit purposes and require lawful, fair, transparent and secure processing. Where consent is relied upon it must be express, freely given, specific, unambiguous, separately obtained, verifiable and capable of withdrawal. The consent should not be buried in an offer letter or general terms. Customers must be told what data is processed, who may access it and how long it will be retained. Data Protection Act, 2019)

The five 2025 Office of the Data Protection Commissioner (ODPC) determinations discussed below in this article put the privacy dimension of the reform rationale into concrete terms: disputed loan registration, unsolicited marketing, continued contact after objection and disclosure of financial records. These subjects align with CBK’s stated concern about abuse of personal information and its objective of strengthening consumer safeguards. Collectively, they support this article’s assessment that privacy and agent-accountability controls warranted stronger supervisory attention. Regulation 21 further links privacy enforcement to licence risk by permitting suspension or revocation where a provider fails to comply with an ODPC administrative action, including an enforcement notice or compensation order.

Why tighter supervision is justified: the statutory basis and enforcement record

CBK’s May 2026 Regulatory Impact Statement identifies sections 57(1), (3) and (4) of the Central Bank of Kenya Act as the enabling basis for regulation and penalties, alongside the Statutory Instruments Act. It explains that the earlier framework sought to address high loan costs, unethical debt collection and abuse of personal information, but continuing challenges and uncertainty over the meaning of “digital” necessitated a wider perimeter following the Business Laws (Amendment) Act, 2024. Stronger consumer safeguards, an enforceable code of conduct and enhanced reporting formed part of the stated response. The previous decisions examined in this article supply practical examples of the problems that make that response necessary: pricing opacity in the competition-law matter; defective recovery procedures in the repossession litigation; and consent, marketing and disclosure failures or disputes in the privacy matters. The defensible attribution is therefore to the recurring problems demonstrated by this enforcement record, not an unsupported claim that each named decision caused the Regulations to be made. The decisions are neither the source of CBK’s legislative powers nor substitutes for its published policy explanation.

Disputed onboarding: Anthony Mwenda Kinoti v Aventus Technology Limited t/a LendPlus

In Complaint No. 0126 of 2025, the complainant alleged that his personal data had been used to register and process a loan application without his authorisation. This allegation illustrates a distinct onboarding risk: possession of identifying information does not, by itself, demonstrate that the person requested credit or authorised the relevant processing. Providers should be able to produce identity-verification records, application and acceptance logs, the applicable privacy notice and evidence of the lawful basis relied upon. A disputed application should trigger investigation before collection or adverse credit reporting continues. No finding of liability or monetary award in this case is asserted here because the available extract does not establish the dispositive orders.

Unsolicited marketing and agent accountability: Samuel Kamau Waweru v Platinum Credit Limited

Complaint No. 1951 of 2024 concerned unsolicited calls and messages promoting loan products without the complainant’s authorisation. A published analysis of the determination reports an award of KES 400,000 compensation, an enforcement notice and a recommendation for prosecution for providing false information to the Commissioner. It also reports that the respondent initially denied an association with the contacting agent. A prosecution recommendation must not be described as a conviction. The compliance lesson is that marketing controls must extend to agents, with verifiable lead sources, consent records and accurate responses to regulatory enquiries. Denying an agency relationship is not a substitute for investigating the evidence.

Ignoring objections: Philip Bolo v Platinum Credit Limited

The determination, contained in Complaint No. 1673 of 2024, concerns unsolicited loan-marketing calls and messages. A published analysis reports that contact continued despite requests to stop, that consent and effective opt-out mechanisms were not demonstrated, and that the ODPC ordered KES 900,000 compensation and issued an enforcement notice for unlawful processing and violations of objection and erasure rights. The practical lesson is that an opt-out must operate across the provider’s systems and agent network, rather than merely removing a number from one salesperson’s handset. Objections should be logged, actioned and tested against subsequent campaigns. The complaint number used here follows the determination rather than the differing entry in the online index.

Remediation and mitigation: Sharamo Wario Issacko v Platinum Credit Limited

A published case record identifies Complaint No. 0621 of 2025 as concerning unsolicited promotional messages without consent and reports an award of KES 50,000 compensation. It records mitigation including an apology and deletion of the complainant’s number, alongside the respondent’s position that some contacts involved brand impersonation. This illustrates why prompt remediation and investigation matter, but an apology or deletion should not be treated as automatically extinguishing liability for earlier processing. Nor should a claim of impersonation replace evidence-based investigation of genuine and unauthorised marketing channels.

Disclosure beyond the lending purpose: Kennedy Omondi Ochieng v Fingrow Capital Limited

Complaint No. 1966 of 2024 concerned alleged disclosure of confidential financial personal data to third parties without consent. A published analysis reports that payslips, bank statements, identification and guarantor information were emailed to a bank’s general customer-service address; the respondent did not answer the complaint, and the ODPC ordered KES 200,000 compensation for unlawful processing. The lesson is purpose-specific disclosure and strict recipient controls: documents supplied for credit assessment should not be circulated more widely merely because a loan exists or is in default. Providers should verify the lawful basis, necessity, recipient and security of each disclosure. The reported award is compensation, not an administrative fine.

The resulting legal exposure: one practice, several routes to liability

Compensation and corrective action. The four reported monetary outcomes above range from KES 50,000 to KES 900,000; some also involve enforcement notices. These are case-specific outcomes, not a tariff or a ceiling. Repeated complaints can increase aggregate exposure and require changes to marketing, onboarding and disclosure systems;

Parallel supervisory exposure. The same conduct may also engage the recovery, outsourcing, consent and consumer-protection provisions discussed in sections 8-11. Where the statutory conditions are met, the sanctions discussed in section 14 may follow. An ODPC finding is not automatically a CBK penalty: each regulator must act within its own powers and procedures;

Licence continuity. The Regulation 21 risk discussed above makes compliance with an ODPC administrative action an operational issue, not merely a litigation expense. Providers should track orders, deadlines, remediation evidence and any appeal or stay. An adverse determination might not be presented as automatic licence revocation; and

Agent and investigation risk. The reported marketing cases illustrate exposure arising from agent conduct and, in Waweru, a recommendation for prosecution over false information. Providers should preserve records and verify regulatory responses; outsourcing or terminating an agent does not by itself resolve the underlying processing issue.

The cases demonstrate pre-existing data-protection exposure and illustrate the rationale for stronger supervision; and do not retrospectively establish breaches of the 2026 Regulations.

12. Artificial intelligence, technology and cybersecurity

Regulation 60 requires explanation of AI-assisted decisions, disclosure when a customer is interacting with AI, human oversight and review, bias assessment, technical robustness, accountability and privacy protection. A provider should maintain a model inventory, data-source register, validation and bias reports, human-review procedure, override logs and customer explanation standards.

Regulations 35, 36 and 61 require reliable information systems, encryption, access controls, audit logs, change management, backups, disaster recovery, threat monitoring and effective authentication. Significant fraud or cybersecurity incidents must be reported within 24 hours under Regulation 66.

13. Credit-reference information, accessibility and reporting

Regulations 33 and 34 require timely, complete and accurate credit information. Negative information should not be submitted where the outstanding amount does not exceed KES 1,000. Customers must ordinarily receive at least 30 days’ pre-listing notice, subject to the shorter but not below seven-day rule for short repayment intervals, and post-listing notification within 30 days.

Regulation 37 requires accessible physical and digital services for persons with visual, auditory and cognitive impairments, together with staff training and formal policies. Accessibility should be incorporated into product design, websites, apps and vendor requirements.

Regulation 66 establishes on-site and off-site supervision and extensive monthly, quarterly and annual reporting. Returns generally fall due within ten days after the relevant period. Audited financial statements are due within three months after year-end, annual compliance certification and fees by 31 December, and significant fraud or cyber incidents within 24 hours.

14. Enforcement and review

Regulation 86 permits institutional penalties up to KES 2 million or three times the gain made or loss avoided, personal penalties up to KES 250,000 for responsible senior officers, continuing daily penalties, disciplinary action, enhanced inspection, remediation plans, restrictions on lending or delivery channels, termination of third-party contracts, and suspension or revocation. Regulation 87 allows assessment for each violation.

Under Regulations 90 and 91, an aggrieved person may seek review within 14 days on the grounds that the violation did not occur, new and directly relevant facts have emerged, or the person was not given an opportunity to show cause. Review does not automatically stay the decision or monetary penalty; a separate suspension request is necessary before the sanction takes effect.

15. Immediate compliance priorities

1. Obtain a perimeter and licensing-status opinion for every product and business line;
2. Complete the Regulation 96 transition plan and submit any required application before the deadline;
3. Audit products, historical variations, rates, charges and total-cost disclosures;
4. Review board composition, group governance, fit-and-proper records and source of funds;
5. Update and approve all core policies, including credit, pricing, consumer protection, complaints, collections, outsourcing, data, AI, cybersecurity and AML/CFT;
6. Re-paper customer agreements, repayment schedules, key information documents, consent and guarantor instruments;
7. Map vendors, assess materiality, make notifications and amend outsourcing contracts;
8. Test reporting data, repayment allocation, NPL interest controls and incident escalation;
9. Train directors, staff, agents and outsourced service providers; and
10. Issue a board-approved readiness report with evidence of closure and residual-risk dates.

Conclusion: compliance must become the operating system

The 2026 Regulations fundamentally change the legal environment for DCPs and other non-deposit-taking credit providers. They expand the regulated market, distinguish licensing from registration, impose recurring charges, control product development and pricing, formalise consumer protection, regulate AI-assisted lending, extend supervision to third parties and create material institutional and personal sanctions.

The previous decisions are consequently more than isolated compliance examples: taken together, they demonstrate the practical need to address opaque pricing, unlawful recovery procedures and misuse of personal information through stronger supervision. Those themes correspond to the concerns identified in CBK’s published policy rationale. This is the basis on which the article links the enforcement record to the reform programme, while distinguishing a reasoned policy connection from unverified assertions about CBK’s reliance on individual cases.

For established DCPs, deemed licensing protects continuity of status. It does not protect outdated contracts, unjustified charges, weak outsourcing, prohibited recovery or deficient data practices. For previously unregulated providers, the six-month period is a structured remediation window, not merely a filing deadline.

How ZMS Advocates LLP can assist

1. Regulatory-perimeter opinions, licensing, registration and conversion applications;
2. Transitional gap assessments and board readiness reports;
3. Source-of-funds, governance and fit-and-proper reviews;
4. Product approvals, pricing and total-cost-of-credit audits as required by CBK;
5. Internal policy development and review;
6. Customer, guarantor, security and recovery documentation;
7. Staff and board training as well as capacity building on various regulatory requirements
8. Data-protection, AI and cybersecurity governance reviews;
9. Third-party materiality onboarding, assessments, CBK notifications and outsourcing agreements;
10. Customer rights and enforcement;
11. Complaints frameworks and annual reporting calendars;
12. Responses to show-cause notices, review applications and judicial-review strategy.

References and linked resources

(2026 NDTCP Regulations) Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026, Legal Notice No. 191, Kenya Gazette Supplement No. 234 (29 September 2026).

(Data Protection Act, 2019) Data Protection Act, 2019 (Kenya Law).

(ODPC 2026 Determinations) Office of the Data Protection Commissioner, 2026 Determinations.

[4] Central Bank of Kenya official website.

[5] Kenya Law official legal information portal.

Additional sources for the case-based analysis. CBK,

Regulatory Impact Statement on the Non-Deposit Taking Credit Providers Regulations, May 2026. ODPC, Anthony Mwenda Kinoti v Aventus Technology Limited t/a LendPlus.

ODPC, Samuel Kamau Waweru v Platinum Credit Limited.

ODPC, Philip Bollo v Platinum Credit Limited.

ODPC, Sharamo Wario v Platinum Credit.

ODPC, Kennedy Omondi Ochieng v Fingrow Capital Limited.

Data Governance Africa’s published analyses of Waweru, Bolo and Ochieng supply the detailed outcomes attributed to them. The African Data Protection Enforcement Tracker’s Sharamo case summary supplies the attributed Sharamo case summary.

Mogo Auto Limited v Otianga [2024] KEHC 13055 (KLR), 22 October 2024.

Luambo v Mogo Auto Ltd & 4 others [2026] KEMC 829 (KLR), 26 August 2026.

Muhinji v Mogo Auto Limited [2025] KEHC 18928 (KLR), 19 December 2025.

Mogo Auto Limited v Ochola [2023] KEHC 17527 (KLR), 4 May 2023, subject to the disposition qualification in section 9.

Movable Property Security Rights Act, Cap. 499A.

Competition Authority of Kenya, decision regarding misleading representation and unconscionable conduct by Mogo Auto Limited, issued 4 October 2024, published as “CAK Decision on Complaints Against Mogo Auto Limited”, particularly paragraphs 1-8 for the penalty, refunds, conduct directions and complaint background.