The Central Bank of Kenya (CBK) gazetted the Non-Deposit-Taking Credit Providers Regulations, 2026 as Legal Notice No 191 in the Kenya Gazette on September 29, 2026, replacing the 2022 Digital Credit Providers Regulations.
The final framework sets a licence fee of KSh100,000, an annual fee of KSh500,000 for licensed providers and KSh250,000 for registered providers, and adds a KSh1 million penalty for licensed providers that miss the December 31 deadline, with a KSh500,000 penalty for registered providers.
Under the previous Digital Credit Providers regime the application fee was KSh5,000 and the annual fee KSh20,000, making the new charges 20 times higher for applications and 25 times higher for annual fees.
The regulations apply to non-deposit-taking credit businesses not covered by other laws, excluding banks, micro-finance institutions, Saccos, co-operative societies, hire-purchase and lease-finance firms, as well as firms whose lending is incidental to selling goods or services.
CBK’s directory listed 281 licensed lenders after 29 more were added on September 28, up from 195 at the end of 2025, and the sector had issued 9,596,509 loans worth KSh165.1 billion by August.
Providers must maintain credit policies, obtain prior written CBK approval before launching a new credit product or changing interest rates, justify any variation and give customers at least 30 days notice, with borrower acceptance required for changes to existing loan terms.
The rules require lenders to disclose the mobile-money account used for disbursements and repayments, the app-based platforms they operate on and their bank-account details, and advertising must prominently display the annual percentage rate and total cost of credit.
Consumer-protection measures include a mechanism for borrowers to opt out of marketing after repayment, the ability to restructure loans, a ceiling on recoveries limited to principal, contractual interest and reasonable costs, and a prohibition on reporting negative credit information for amounts of KSh1,000 or less.
Regulation 60 obliges lenders using artificial intelligence in credit decisions to explain automated outcomes, inform customers when they are dealing with an AI system, retain human oversight, assess models for bias and ensure data-privacy and security.
CBK may fine a provider up to KSh2 million or three times the gain made or loss avoided, fine a senior officer up to KSh250,000 plus KSh10,000 for each day a breach continues, and bar directors, senior officers and significant shareholders from holding office for three years; licences may be revoked if late fees are not paid within three months.
Existing providers have six months from publication to apply for a licence or registration, putting the deadline at about March 29, 2027, and may continue trading while CBK decides on their applications.
The new regime stems from amendments to the CBK Act under the Business Laws (Amendment) Act 2024, which broadened the regulator’s scope beyond digital lending to cover a wider range of credit products such as buy-now-pay-later, stock-now-pay-later, peer-to-peer and “pay-as-you-go” arrangements.
