Kenya's credit providers face higher fees and tighter CBK controls under new regulations
Kenya’s non-deposit-taking credit providers now face a Sh1 million penalty if they fail to pay their annual regulatory fees by December 31, under new rules issued by the Central Bank of Kenya (CBK). The regulations also raise licensing and annual fees while giving CBK tighter oversight of credit products, pricing, customer information and digital lending platforms.
The Sh1 million charge is a new provision compared with the draft regulations CBK published in 2025. Under the final framework, providers seeking a licence or registration will pay Sh100,000, while licensed providers will pay an annual Sh500,000 fee and registered providers Sh250,000. Under the previous Digital Credit Providers regime, the application fee was Sh5,000 and the annual fee was Sh20,000, putting the new charges well above the costs lenders faced under the earlier framework.
CBK puts a Sh1 million price on late annual fees
The late-payment provision is significant because the annual fee itself is now a much larger recurring obligation. A licensed provider that misses the December 31 deadline faces a Sh1 million charge on top of the Sh500,000 annual fee, according to the final regulations.
The provision gives lenders a strong financial incentive to keep their regulatory payments current, while the broader sanctions framework gives CBK additional powers to deal with other breaches of the rules.
The new fees also arrive as Kenya’s digital lending market has expanded rapidly. By September, CBK had licensed 281 digital credit providers, up from 195 at the end of 2025, while lenders had issued 9.6 million loans worth Sh165.1 billion by August. Digital providers have also moved beyond the small short-term loans that defined the early market, with businesses now offering credit for areas such as business operations, education and asset financing.
That growth provides important context for the new framework. CBK is overseeing a credit market that is considerably larger and more diverse than the one that prompted the introduction of digital lender licensing in 2022.
The cost of entering and staying in the market rises
The new fee structure changes the economics of compliance, particularly for smaller providers. An application that previously cost Sh5,000 now costs Sh100,000, while the annual fee for a licensed provider rises from Sh20,000 to Sh500,000.
The annual charge is therefore 25 times the previous fee, while the application fee is 20 times higher. A registered provider will pay Sh250,000 annually under the new framework.
These are fixed regulatory costs, so their effect will be more pronounced for lenders with smaller loan books or limited product lines. The regulations do not establish that smaller lenders will leave the market, but the higher cost of maintaining regulatory status creates a business question around scale, pricing and the viability of smaller credit providers.
The financial obligation is also only one part of the compliance burden. Providers must maintain policies and systems covering credit assessment, customer information, technology, complaints and other areas of their operations, while CBK has greater visibility over the products they offer and the channels through which they disburse and collect loans.
CBK widens the rules beyond digital lending
The move to non-deposit-taking credit providers follows amendments to the CBK Act under the Business Laws (Amendment) Act, 2024. The legislative changes widened the regulatory concept beyond digital lending, creating a framework for credit businesses that can operate through different channels and offer a broader range of credit products.
That distinction matters because Kenya’s credit market has developed considerably since CBK introduced licensing for digital lenders. Digital credit is now connected to mobile money, alternative credit scoring, app-based customer acquisition and other forms of data-driven lending.
Banks are also using some of the techniques associated with fintech lenders, including alternative data and digital credit scoring. The regulatory questions around data, automated decisions and customer treatment therefore extend beyond standalone loan apps.
The final regulations replace the 2022 Digital Credit Providers Regulations. Existing providers licensed under that framework are being transitioned into the new regime, subject to the requirements and timelines set out in the regulations.
The transition also gives existing providers a limited period to bring their businesses under the new framework. The final rules provide a six-month period from publication for existing providers to apply for licensing or registration under the NDTCP regime.
Lenders face tighter controls over products and pricing
One of the most consequential provisions for lenders concerns changes to credit products. An NDTCP must formulate a credit policy that fits the size of its business and the nature and complexity of the products it offers.
The regulations also require prior written approval from CBK before a provider introduces a new credit product or changes features of an existing product, including interest rates.
A provider seeking to make such changes must justify the variation and notify customers at least 30 days before the changes take effect.
This gives CBK a more direct role in how non-deposit-taking lenders alter their products after entering the market. For borrowers, the practical effect could be greater predictability when a lender changes the terms, pricing or structure of a credit product.
The rules also require providers to identify the mobile-money account used for loan disbursements and repayments, disclose the app-based platforms they intend to operate and provide details of their bank accounts.
For a sector built heavily around mobile money, those requirements give the regulator greater visibility over the infrastructure through which lending transactions are conducted.
Borrowers get new protections under the rules
Consumer protection runs through several sections of the new framework. Digital and app-based providers must provide customers with a mechanism to unsubscribe or opt out of the service, including marketing messages after a loan has been fully repaid.
The provision addresses a familiar complaint about digital lending, where the relationship between a lender and borrower can continue through promotional messages even after a credit facility has been settled.
Under the new rules, providers must make it possible for customers to stop receiving marketing and promotional communication.
The regulations also provide for loan restructuring, subject to a provider’s credit policy. A loan may be restructured in terms of instalment amounts, repayment periods or other terms following a borrower’s request or prior notification to the customer.
There are also restrictions on what an NDTCP may recover from a non-performing loan. The provision places a ceiling on recoveries by reference to limits set elsewhere in the regulations, adding another constraint to how lenders handle loans that have fallen into default.
These measures build on problems that have shaped Kenya’s digital lending debate, including aggressive debt collection and the use of customer information. Earlier regulatory disputes involving digital lenders have also brought the handling of borrowers’ personal information under scrutiny, giving the consumer-protection provisions in the new framework a practical context beyond the wording of the regulations.
AI lending now falls under explicit CBK requirements
For the technology sector, one of the most significant provisions in the final regulations may be Regulation 60, which deals specifically with the use of artificial intelligence in lending decisions.
The regulation requires an NDTCP using AI for lending decisions to ensure that automated decisions affecting a loan application can be explained to customers. Customers must also be told when they are interacting with an AI system rather than a human agent, while lenders must maintain human oversight and review of AI and automated credit decisions.
The rules further require attention to discriminatory bias and unfair outcomes, technical robustness and accuracy, transparency and accountability around AI algorithms and appropriate management of data privacy and security.
The provision moves beyond regulating the outcome of lending and addresses some of the technology used to reach that outcome. A lender using automated models will have to consider how a credit decision can be explained, who can review it, whether the model produces unfair outcomes and whether the underlying data and systems are properly controlled.
That could become particularly relevant as alternative credit scoring becomes more common in Kenya. Digital lenders and banks are already using combinations of income information, credit-reference data, account activity and other alternative indicators to assess borrowers.
The regulations therefore place explicit regulatory obligations around technologies that can influence whether a customer receives credit and on what terms.
What the new framework means for Kenya’s credit market
The new rules arrive at a point when digital credit has become a sizeable part of Kenya’s financial system. CBK’s licensing programme began with a focus on bringing previously unregulated digital lenders into the formal regulatory system, but the market has since expanded in volume, business models and the technology used to assess and serve borrowers.
The final NDTCP regulations respond to that wider market. They raise the cost of regulatory compliance, give CBK greater control over product and pricing changes, impose specific obligations around customer communication and information, and establish requirements for lenders using AI in credit decisions.
For lenders, the immediate task is compliance with a framework that carries materially higher fixed fees and a broader set of operational requirements. For borrowers, the more visible consequences may come through product changes, notice requirements, marketing controls, restructuring options and restrictions on loan recovery.
The Sh1 million late-payment charge is the clearest news hook in the new regulations, but it sits within a much broader regulatory reset. Kenya now has a substantially larger non-deposit-taking credit market to supervise than it did when the DCP regime was introduced, and Legal Notice No. 191 gives CBK a wider rulebook for doing so.
Real ESG impact doesn’t happen in panels alone, it happens in the rooms where financiers, operators, and policymakers actually align. Our GreenShift Forum 2026 cuts the noise, bringing together the people rewiring Africa’s sustainability and energy frameworks for one focused day in Nairobi. Secure your seat.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to info@techtrendsmedia.co.ke
