A Sweeping CBK Legal Review Could Expand Oversight of Fintech, Crypto, and Mobile Banking in Kenya

The CBK law review has arrived at an awkward moment for Kenya’s financial system. The Central Bank of Kenya is not short of authority on paper. It supervises 39 commercial banks, 14 microfinance banks, 1 mortgage financier, and 195 digital lenders. It manages inflation and money supply. It oversees payments. Yet beyond those clearly defined lanes, a growing cluster of financial technology firms has expanded into payments, savings, cross-border transfers, payroll, and credit facilitation with limited direct supervision.

Now the regulator is recruiting a consultant to undertake a comprehensive legal review of the Central Bank of Kenya Act and the Banking Act. The stated aim is alignment with international standards and Kenya’s evolving regulatory needs. The deeper story is about jurisdiction.

For years, Kenya’s fintech scene grew faster than the law that framed it. Mobile money created a payments culture that startups could plug into. APIs opened banking rails. Venture capital followed. The result is an ecosystem that feels mature in user numbers and product sophistication, but uneven in legal footing.

The review seeks to strengthen provisions around digital banking, fintech regulation, consumer protection, and cybersecurity. That language reads technical. The implications are not.

The Regulator’s Expanding Perimeter

The Central Bank of Kenya already regulates deposit-taking institutions and, since 2022, digital lenders. That extension came after public outcry over harassment, opaque pricing, and misuse of personal data. The Digital Credit Providers framework brought 195 lenders under oversight. It also demonstrated how quickly a regulatory blind spot can become a reputational problem.

Fintech companies beyond digital credit have largely operated outside the central bank’s direct remit, unless they require access to the national payment system. That leaves a large share of startups in a grey zone. Some operate through partnerships with licensed banks. Others rely on sandboxes managed by separate regulators. Many function in a patchwork environment where compliance obligations depend on product design rather than business impact.

The CBK law review appears designed to close that perimeter. If enacted, amendments to the CBK Act and the Banking Act could formalize authority over payment aggregators, embedded finance platforms, cross-border remittance apps, and payroll intermediaries. Firms such as Chipper Cash, WapiPay, YoguPay, Jumo, Pezesha, Mogo, WorkPay, and Pyypl illustrate the range of services now in circulation. Their regulatory touchpoints differ. Their systemic footprint does not.

When money flows through an app, the public rarely distinguishes between a bank balance and a wallet balance. Risk perception blurs. That blurring becomes a policy problem.

Digital Banking’s Risk Profile Has Changed

Banks themselves are no longer brick-and-mortar institutions with mobile add-ons. Mobile applications and digital onboarding now sit at the core of lending and payments. That increases exposure to cyber risk, fraud vectors, and outsourced technology dependencies.

Kenyan banks operate in an environment where cyberattacks are not hypothetical. The more activity migrates online, the more the regulator must consider operational resilience as part of prudential oversight. Existing statutes were written for balance sheets and branch networks, not cloud infrastructure and API integrations.

The CBK law review suggests the regulator wants clearer authority to address cybersecurity obligations. That may translate into mandatory reporting timelines for breaches, minimum capital requirements tied to digital risk exposure, or prescriptive standards for third-party technology providers. If those elements appear in revised legislation, fintech firms could find themselves facing compliance burdens closer to those of licensed banks.

There is a tension here. Kenya’s digital finance growth has been powered by relative regulatory flexibility. Formalizing stricter controls may reduce experimentation. It may also reduce consumer harm. The balance will not be theoretical. It will affect product pricing, capital allocation, and market entry barriers.

Crypto Regulation Enters the Frame

The review unfolds as Kenya prepares to implement the Virtual Asset Service Providers Act. The law assigns oversight of crypto companies offering payment services to the Central Bank of Kenya, while investment and exchange services fall under the Capital Markets Authority. Implementation now depends on action by the Treasury Cabinet Secretary.

Crypto firms have operated in Kenya through peer-to-peer platforms and offshore exchanges, largely beyond direct supervision. Bringing them into the regulatory fold will require clarity on licensing thresholds, capital requirements, and consumer safeguards. It also forces the central bank into territory that sits between monetary sovereignty and financial innovation.

If crypto payment providers are licensed under a revised CBK Act, the regulator will face a new set of monitoring challenges. Transaction tracing, custody standards, and cross-border flows differ from traditional payment systems. The legal architecture must anticipate that complexity rather than retrofit it later.

Constitutional and Institutional Boundaries

The tender document references alignment with the Kenyan Constitution and international best practices. That phrase points to institutional design questions. Expanding CBK’s authority must coexist with mandates held by other regulators, including the Capital Markets Authority and the Communications Authority. Turf friction is common in fast-evolving sectors.

If amendments broaden the definition of regulated financial service providers, legal disputes may follow. Firms that built models around regulatory arbitrage may resist reclassification. Court challenges are not improbable. The drafting precision of any amendments will matter.

There is also a constitutional dimension to consumer protection and data handling. Kenya’s data protection regime imposes its own compliance obligations. Overlapping requirements could either strengthen safeguards or create duplicative reporting burdens. The CBK law review will need to reconcile these layers rather than stack them.

The Economics Beneath the Legal Language

Regulation is not abstract. It shapes cost structures. If fintech firms face new licensing fees, capital buffers, or cybersecurity audits, those expenses will feed into pricing. Consumers may encounter higher transaction charges. Smaller startups may struggle to scale. Larger firms with foreign backing may consolidate market share.

At the same time, clearer oversight could attract institutional investors who prefer regulated environments. Banks might deepen partnerships with fintech firms that operate under defined rules. Credit risk management may improve if data standards become uniform.

Kenya’s digital finance model has often been celebrated for inclusion. Yet inclusion without guardrails can produce over-indebtedness, fraud exposure, and data misuse. The regulator’s calculus is not ideological. It is institutional. The CBK must protect financial stability while allowing innovation to proceed. The friction between those goals is permanent.

An Inflection Point for Kenya’s Fintech Era

The CBK law review is less about rewriting statutes and more about deciding how wide the central bank’s lens should be. The financial system no longer fits neatly into categories drafted decades ago. Apps behave like banks. Wallets resemble deposits. Code executes credit decisions in seconds.

If the amendments are narrow, Kenya will preserve much of its current fintech dynamism, at the cost of continued grey zones. If they are expansive, the sector will enter a more formal phase, where compliance departments grow and product rollouts slow.

Neither path is neutral.

What emerges from this legal exercise will shape how money moves in Kenya for the next decade. The central bank is not merely updating text. It is defining the boundary between innovation and oversight in a market that has blurred that line for years.

Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world. 

Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke