The Central Bank of Kenya (CBK) has gazetted rules that bring every lender outside existing financial laws under its supervision. The Central Bank of Kenya (Non Deposit Taking Credit Providers) Regulations, 2026, appear as Legal Notice No. 191 in Kenya Gazette Supplement No. 234 of 29 September 2026.
They replace the Digital Credit Providers Regulations, 2022.
Who falls under the new rules
The regulations apply to non deposit credit businesses that no other law regulates. They exclude banks, microfinance institutions, Saccos, co-operative societies, hire purchase arrangements and lease finance. They also exclude firms whose lending is incidental to selling goods or services.
The definition of a loan now names buy now pay later, stock now pay later and peer to peer lending. The rules also cover “pay as you go” arrangements, in which a provider can deactivate or repossess an asset when a customer misses payments.
Licence, registration and deadlines
No person may run a non deposit credit business without a CBK licence or registration. A new business with initial capital of at least KSh20 million applies for a licence. Smaller firms register. A registered provider must apply for a licence once its capital, borrowings or loan book exceeds KSh20 million.
Lenders already operating outside regulation have six months from publication to apply, which puts the deadline at about 29 March 2027. They may keep trading while CBK decides, subject to any conditions it sets. Lenders licensed under the 2022 rules are deemed licensed under the new regime.
That group is large. CBK licensed 29 more digital credit providers on 30 September, taking the total to 281. The regime began when the Central Bank of Kenya (Amendment) Act, 2021, gave the regulator power over digital lenders, as Khusoko reported. CBK licensed its first batch of lenders in 2022.
CBK approval for products and price changes
Under regulation 26, a provider cannot launch a credit product or change a product’s features or interest rates without the “prior written approval of the Bank.”
It must justify any change and give customers at least 30 days’ notice. Regulation 55 adds that a provider cannot vary the terms of a signed loan without 30 days’ notification and the borrower’s acceptance.
Advertising and marketing material, in print or digital form, must state the annual percentage rate and the components of total cost of credit. Providers must display both prominently in their premises, on their websites and in other publications.
Limits on recovery and credit reporting
A provider cannot recover more than the principal owing when a loan turns non performing, plus contractual interest capped at that same principal, plus reasonable recovery expenses. Providers also cannot report a customer’s negative credit information to a credit reference bureau when the outstanding amount is KSh1,000 or less.
Rules on artificial intelligence
Lenders that use artificial intelligence in credit decisions must explain automated decisions that affect a loan application. They must tell customers when they are dealing with an AI system rather than a person, and keep human oversight and review of automated decisions. They must also assess their models for discriminatory bias and unfair outcomes.
Penalties
CBK can fine a provider up to KSh2 million, or three times the gain made or loss avoided, whichever is higher. It can fine a responsible senior officer up to KSh250,000, and add up to KSh10,000 for each day a breach continues. It can also bar directors, senior officers and significant shareholders from holding office in any CBK licensed provider for three years.
Digital Credit: Need and Demand for Consumers’ Financial Literacy
