CBK to Regulate Digital Lenders: The Central Bank of Kenya (Amendment) Act, 2021 Passed Into Law

Background to the Legislation

The Central Bank of Kenya (Amendment) Act, 2021 (hereinafter, the Act) is the latest development in the quickly evolving digital lending space in Kenya. Over the past decade or so, Kenya has achieved significant financial inclusion thanks to increased penetration into the market brought about by advances such as mobile banking, digital lending and mobile wallets.

Digital lending has risen steeply due to its convenience and accessibility. Owing to its ever-expanding market and use, it has become necessary to tighten the regulation around digital lending, so as to make the same less susceptible to abuse and/or unethical dealings. It is against the foregoing background that the Act was passed into law by the President on 7th December 2021.

Principal objectives of the Act 

A. Regulation of Digital Lenders and Consumers by the CBK

The amendment brings digital lenders and borrowers under the regulatory ambit of the Central Bank of Kenya (“CBK). The digital lending marketplace has been unregulated or rather self-regulating since its inception which led to the emergence of unscrupulous digital lenders who sometimes employed unethical or illegal methods of debt collection such as debt shaming, predatory lending, charging exorbitant interest rates, illegal sharing of defaulters’ data among others. The Act now empowers CBK to regulate all the digital credit providers to curb the foregoing.

Among others, CBK shall license digital credit providers; determine capital adequacy requirements for digital credit providers; determine the minimum liquidity requirements for digital credit providers; approve digital channels and business models through which digital credit businesses may be conducted; supervise digital credit providers; circumstances permitting-suspend or revoke any license; and direct or require such changes as it may consider necessary.

B. Registration of Existing Digital Lenders within Six (6) Months

The Act mandates CBK to publish the regulations to fast-track the carrying into effect of the new amendments, within three (3) months’ time.

Since the registration procedures will be contained in the yet to be published regulations, the implication is that registration will commence in earnest, once the regulations have been published. Hence, existing digital credit providers have about three (3) months to ensure that they register their businesses, or risk falling afoul of the Act with attendant penalty.

C. Reporting Obligations & Other Requirements for Digital Lenders

Digital credit businesses handle billions of shillings, control or process a significant amount of borrowers’ personal data, and deal with a huge body of clientele. As such, they are required to comply with the existing legal framework on the management and processing of personal data that is compliant with Data Protection Act, 2019. This is especially important because some digital lenders have been adversely cited for unlawful sharing of personal data of their customers.

In the same vein, digital lenders will be required to comply with the credit information sharing. However, it is unclear yet if they will be required to submit customer credit information reports to Credit Reference Bureaus (“CRBs”) and if the CRBs will, in turn, supply them with individual credit information reports. We note to keep you apprised should CBK publish the regulations to operationalize these amendments.

D. Penalties for Non-compliance

The Act prohibits any person from engaging in the digital credit business without a license and in this regard provides a penalty of imprisonment for a term not exceeding three (3) years or a fine not exceeding Kenya Shillings five million (KES 5,000,000) or to both.

Please click here to download the alert.


This alert is for informational purposes only and should not be taken or be construed as a legal opinion. If you have any queries or need any clarifications as to how any aspect of the amendments might affect you, please do not hesitate to contact John Mbaluto, FCIArb, Deputy Managing Partner (john@oraro.co.ke), Hellen Mwongeli, Associate (hellen@oraro.co.ke) or your usual contact at our firm.