Kenya’s 2026 Non-Deposit-Taking Credit Providers Regulations: Commencement, affected lenders, CBK compliance and borrowers’ rights

CM REGULATORY ALERT 

A legal guide to the new regulatory framework, licensing and registration obligations, loan pricing approvals, early repayment rights and non-performing loans 

Executive summary 

The Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026, published under Legal Notice No. 191 of 2026 in the Kenya Gazette of 29 September 2026, establish a substantially expanded regulatory framework for non-deposit-taking credit providers in Kenya. The Regulations represent a significant development in the supervision of Kenya’s non-bank lending market. They extend regulatory attention beyond conventional digital lending to a broader category of qualifying credit providers, subject to the statutory definitions, thresholds and exclusions. 

The framework addresses market entry, CBK licensing and registration, ownership and governance, credit pricing, responsible lending, consumer protection, loan administration, artificial intelligence, data protection, regulatory reporting and enforcement. Particularly important are Regulations 55, 56 and 57, which introduce requirements concerning changes to loan pricing, customer acceptance, repayment allocation, early settlement and non-performing loan classification. 

The principal legal and commercial implications are as follows: 

1. Expanded regulatory coverage: Businesses should assess whether their credit activities now fall within CBK’s licensing or registration framework, even where they do not operate a conventional digital lending platform. 

2. Regulatory authorisation: Qualifying providers must determine the applicable licensing or registration category, including the relevance of the KES 20 million financial thresholds. 

3. Transitional compliance: Existing providers whose credit business is not regulated under any other written law must apply for a licence or registration within six months of publication, that is, by 29 March 2027 (Regulation 96(1)), and prepare for the applicable operational requirements. 

4. Credit pricing controls: Regulation 55 requires prior written CBK approval before changing pricing parameters or credit terms, together with at least thirty days’ customer notice and acceptance. 

5. Borrower protections: Regulation 56 prescribes repayment allocation and protects borrowers against early repayment penalties and future-period interest following full early settlement. 

6. Credit risk management: Regulation 57 introduces criteria for identifying non-performing loans, requiring appropriate credit policies, loan classification systems and regulatory reporting. 

7. Continuing compliance: Regulated providers must implement appropriate governance, technology, risk management and consumer protection controls. 

The immediate priority for lenders is to establish whether they are regulated, identify the correct authorisation category and develop a documented compliance plan covering both market-entry requirements and continuing operational obligations. 

1. General Legal Summary of the 2026 Regulations 

The Regulations establish a regulatory framework for qualifying businesses that provide credit without undertaking deposit-taking activities. They should be read alongside the Central Bank of Kenya Act, the Data Protection Act, 2019, applicable consumer protection legislation, anti-money laundering legislation and other relevant financial services laws. The framework addresses several interconnected regulatory areas. 

Regulation 97 revokes the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 (Legal Notice No. 46 of 2022), while Regulation 96 preserves the position of providers licensed under that earlier regime. The resulting framework is relevant not only to existing digital lenders but also to other businesses whose lending models fall within the broader statutory definition of non-deposit-taking credit provision. 

2. Commencement Date and Transitional Compliance 

The Regulations were published on 29 September 2026 under Legal Notice No. 191 of 2026. It is important to distinguish three dates: the date the Regulations were made, the date of Gazette publication and their legally operative commencement date. The Gazette identifies 4 September 2026 as the date the Regulations were made. The publication date is 29 September 2026. Accordingly, under section 23(1) of the Statutory Instruments Act, 2013, which provides for the commencement of statutory instruments upon publication unless a different commencement date is specified, 29 September 2026 is the applicable commencement date, subject to the statutory qualifications. 

Six-month transition for existing providers 

Regulation 96 establishes a six (6) month transitional framework for persons who, at commencement, were conducting non-deposit-taking credit business not regulated under any other written law. Regulation 96(1) runs the six-month period from publication of the Regulations. The application window therefore closes on 29 March 2027. The transitional framework is particularly important for businesses that previously operated outside CBK’s digital credit provider licensing regime but may now fall within the expanded scope. 

What existing lenders should do during the transition 

Existing providers should use the transition to establish their regulatory status, determine whether licensing or registration is required, prepare the necessary application documentation and implement required operational changes. The transition should not be treated as a blanket exemption from every applicable legal obligation. Under Regulation 96(2), an applicant may continue its business pending determination of its application, but only subject to the Act, the Regulations and any conditions issued by CBK. Businesses should therefore apply within the window and confirm which conditions or restrictions apply to their particular activities. 

3. Which Lenders and Financial Services Businesses are Affected? 

The central question is whether a business undertakes non-deposit-taking credit activities that are not already regulated under another applicable written law. The scope is determined by the legal substance of the financing arrangement, not simply by whether the business describes itself as a lender, fintech company, microfinance institution or technology provider. 

3.1. Categories of businesses potentially affected 

The statutory definitions expressly contemplate a range of contemporary credit models, including buy-now-pay-later, stock-now-pay-later and peer-to-peer lending.  

3.2. Businesses that may be excluded 

Regulation 3 provides exclusions relevant to businesses already regulated under other legislation. These include, subject to the precise statutory conditions, banks licensed under the Banking Act, credit guarantee companies and providers regulated under the Central Bank of Kenya Act, institutions licensed under the Microfinance Act, co-operative societies registered under the Co-operative Societies Act, Sacco societies licensed under the Sacco Societies Act, hire-purchase arrangements under the Hire-Purchase Act, lease finance transactions regulated under any written law, and other businesses whose credit activities are regulated under separate written laws. Credit that is merely incidental to a business's primary activity of selling goods or providing services may also fall within an exclusion. 

A non-deposit-taking microfinance company should not be confused with an institution licensed under the Microfinance Act. The applicable regulatory treatment depends on its actual authorisation and business activities. Similarly, a merchant offering deferred payment for its own goods should not automatically be treated in the same way as an independent third-party credit provider. A business relying on an exclusion should document the legal basis for that position.  

4. Licensing or registration: Which regulatory category applies? 

The Regulations introduce a differentiated licensing and registration framework. Under Regulation 6, a person whose initial capital is not less than KES 20 million must apply for a licence. Under Regulation 11, a registered provider must apply to convert to a licence once its capital, borrowings or loan book exceeds KES 20 million, and CBK may also direct conversion following non-disclosure or rapid expansion. The KES 20 million threshold is a significant consideration. Businesses should assess the relevant statutory tests rather than relying on a single financial indicator. 

Regulatory fees 

Annual fees are payable on or before 31 December each year. For licensees, late payment within three months attracts double the annual fee and continued non-payment may lead to revocation (Regulation 7(4) to (6)). The Third Schedule also lists a late penalty fee of KES 1,000,000 for payment after 31 December. The framework provides further consequences for continuing regulatory non-compliance. 

Different compliance paths for existing and new providers 

Existing licensed digital credit providers: Regulation 96 preserves the continuity of authorisation under the earlier regime. Such providers are deemed licensed under the new framework, but must assess and comply with the additional substantive obligations. 

Existing providers not previously authorised: Qualifying businesses operating at commencement must apply for licensing or registration within six months of publication, that is, by 29 March 2027 (Regulation 96(1)). 

Pending applicants: Applications pending under the earlier regime are to be processed under Part II (licensing) or Part III (registration) of the Regulations, as the case may be (Regulation 96(6)). 

New market entrants: Businesses commencing regulated credit operations should establish and obtain the required authorisation before undertaking activities for which approval is required.  

5. Regulatory commencement and compliance timeline 

6. Compliance Obligations During the Transitional Period 

The transitional framework should not be interpreted as an unrestricted exemption from regulatory obligations. Existing credit providers should establish whether their activities fall within the Regulations, determine whether licensing or registration is required, prepare the relevant application documentation and review their operational arrangements against the applicable requirements. 

Importantly, the six-month deadline concerns the transitional application requirements prescribed by Regulation 96(1). It should not be assumed to constitute a general extension of every substantive compliance obligation or a guarantee that regulatory authorisation will be granted by that date. Businesses continuing operations during the transitional period must comply with the conditions prescribed by Regulation 96 and any other applicable legal or regulatory requirements. Early preparation is therefore essential to minimise regulatory exposure, avoid disruption to lending operations and support an orderly transition to the new CBK supervisory framework. 

7. Core Operating Requirements: What Affected Providers Must Comply With 

The authorisation process is only one component of the new framework. Affected businesses should also implement the substantive requirements relevant to their activities. 

1. Credit Products, Pricing and Customer Acceptance 

Regulations 26 and 55 introduce regulatory oversight of credit products, pricing and changes to credit terms. Regulation 55 specifically requires prior written CBK approval, at least thirty days' customer notice and acceptance before covered changes are implemented. Credit agreements, variable-rate provisions, pricing engines and customer communication systems should be reviewed. 

2. Loan Repayment and Early Settlement 

Regulation 56 requires repayments to be credited on the payment date and allocated in the following sequence: 

1. Due principal payment. 

2. Outstanding fees and charges. 

3. Interest due. 

Borrowers may repay early, wholly or partially, without advance notice or penalties. Full early settlement also extinguishes the obligation to pay interest for the remaining loan period. Lenders should amend inconsistent contractual terms and repayment allocation systems. 

3. Non-Performing Loans and Credit Risk 

Regulation 57 establishes classification criteria for non-performing loans: a loan becomes non-performing where principal or interest remains outstanding after 30 days (for loans of 30 days or less) or after 90 days (for longer loans), or where any payment obligation remains unpaid for the period specified in the loan agreement. Lenders must state that default period in both their credit policy and their loan agreements. Lenders should review default periods, arrears management, collections procedures, credit policies and portfolio reporting. They should also note that Regulation 29 caps what may be recovered on a non-performing loan at the principal owing when the loan became non-performing, contractual interest not exceeding that principal, and reasonable recovery expenses.  

4. Responsible Lending and Customer Complaints 

Providers must maintain appropriate arrangements for borrower assessment, disclosures, complaints handling and fair customer treatment. Regulation 40 addresses complaints resolution, including written acknowledgement within seven days where a complaint cannot be dealt with promptly, and resolution within thirty days of the complaint being reported. 

8. Practical Compliance Roadmap for Industry Players 

9. Regulatory Enforcement and Consequences of Non-Compliance 

The framework is supported by CBK supervisory and enforcement powers. Regulation 86 provides for administrative sanctions, including monetary penalties of up to KES 2 million or three times the gross amount of the monetary gain made or loss avoided, whichever is higher, together with a separate penalty of up to KES 250,000 on a responsible senior officer and additional penalties of up to KES 10,000 for each day non-compliance continues. Unauthorised regulated credit business may also attract consequences under the Central Bank of Kenya Act. Compliance failures can create additional exposure through borrower complaints, contractual disputes, regulatory investigations and reputational harm.  

10. How we can assist 

CM Advocates LLP advises financial institutions, credit providers, fintech companies, investors, founders and other financial services participants on the legal and regulatory requirements governing lending activities in Kenya. Through our Corporate, Commercial & Regulatory Compliance (CCRC) Department, including the Financial Services, Innovation & Regulation (Fin-SIR) Practice and Business Establishment & Compliance Advisory (BECA) Practice, we provide integrated assistance with regulatory classification, market entry, CBK licensing and registration, governance, lending documentation, product approvals, consumer protection, technology risk and continuing compliance. Our services also include regulatory due diligence, corporate restructuring, investment transactions, responses to regulatory investigations and dispute resolution. 

Contact us 

For advice concerning CBK licensing and registration, non-deposit-taking credit providers, digital lending, microfinance regulation, buy-now-pay-later arrangements, loan pricing approvals, early repayment rights, non-performing loans, corporate governance, regulatory compliance, business establishment, investment transactions or related disputes, please contact: 

Corporate, Commercial & Regulatory Compliance (CCRC) Department 
E: corporate.commercial@cmadvocates.com 

Financial Services, Innovation & Regulation (Fin-SIR) Practice 
E: finsir@cmadvocates.com 

Business Establishment & Compliance Advisory (BECA) Practice 
E: beca@cmadvocates.com 

CM ADVOCATES LLP 

Head Office – Nairobi 

I&M Bank House, 7th Floor 
2nd Ngong Avenue 
Nairobi. 

E: law@cmadvocates.com 

Mombasa Office 

Links Plaza, 3rd Floor 
Links Road, Nyali 
Mombasa. 

E: mombasaoffice@cmadvocates.com 

Regional Presence 

Uganda | Tanzania | Rwanda | Zambia | Ethiopia | South Sudan 

Disclaimer: This Regulatory Alert provides general information and does not constitute legal, regulatory, tax or investment advice. Specific advice should be obtained concerning the applicability of the Regulations, licensing or registration, transitional compliance, lending products, contractual obligations and available remedies. 

© 2026 CM Advocates LLP. All Rights Reserved. 

Protecting Innovation. Preserving Value. Powering Commercial Growth.