Obtaining A Psp License In Kenya: A Comprehensive Legal And Regulatory Guide

Introduction 

Kenya continues to establish itself as a continental leader in digital finance and mobile payments. With innovations such as M-PESA, mobile banking, and e-commerce reshaping how people transact, the regulatory framework governing payment services has become central to maintaining the stability, safety, and integrity of the financial system. 

In this context, any person or entity intending to offer payment services whether processing retail payments, facilitating e-commerce collections, operating digital wallets, or acting as an aggregator, must obtain a Payment Service Provider (PSP) license from the Central Bank of Kenya (CBK). This requirement is grounded in the National Payment System Act, 2011 and the National Payment System Regulations, 2014, which together create a detailed compliance regime for PSPs in Kenya. 

The PSP license is more than a regulatory formality; it is a legal obligation and a mark of credibility for any entity intending to operate within Kenya’s formal financial infrastructure. The CBK’s licensing process is rigorous and requires a comprehensive demonstration of operational capacity, financial integrity, governance structures, and consumer protection mechanisms. 

This article sets out the step-by-step process, key regulatory requirements, and legal considerations for obtaining a PSP license in Kenya. It further explores how licensed entities are supervised. 

Why a PSP License Matters 

Operating as a PSP without a license is a criminal offence under Kenyan law. Beyond legality, licensing: 

• Provides regulatory legitimacy; 
• Facilitates partnerships with banks and other financial institutions; 
• Enables access to Kenya’s national payment infrastructure; 
• Builds consumer and investor confidence; and 
• Demonstrates commitment to AML/CFT and data protection compliance. 

The CBK’s oversight also ensures PSPs operate in a manner that promotes innovation while safeguarding systemic integrity. 

Licensing Requirements: A Step-by-Step Overview 

The CBK outlines ten comprehensive sections of documentation and disclosures that applicants must satisfy. These are summarized below: 

1. Preliminary Engagements and Application Submission 

• Confirm whether your services fall within the scope of a PSP under the NPS Act. These include the following types of PSPs: Electronic Retail Payment Service Provider, Designated Payment Instrument Issuer, E-Money Issuer and Small E-Money Issuer. 
• Initiate contact with CBK and seek business name approval. 
• Submit Application Form 1, a sworn affidavit, and pay the KES 5,000 non-refundable fee. 

2. Company and Product Name Approval 

In addition to submitting three proposed business names, you are also required to submit the following: 

• Detailed business model and scope of operations; 
• Governance and ownership structure; 
• Capitalisation plan and financial projections; and 
• Internal control and risk management outlines.  

3. Company Documents 

You must provide: 

• Certified copies of incorporation documents of the applicant; 
• Tax compliance and credit reference certificates; 
• Applicable sectoral licenses (e.g. from the Communications Authority); and 
• For foreign entities, provide letters of no objection, board resolutions, and regulatory cooperation guarantees. 

 4. Evidence of Capital 

Applicants must: 

• Demonstrate compliance with the capital thresholds set under the First Schedule of the NPS Regulations; 
• Present valid bank statements or investment in Treasury Bills/Bonds; and 
• Disclose capital contributors and sources of funds with affidavits confirming funds are not proceeds of crime. 

5.Business Plan 

A comprehensive business plan is mandatory and must include: 

• The business model and services to be offered; 
• Operational strategy, controls, and delivery channels; 
• Financial forecasts for at least three years; 
• Details of public interest served and market justification; and 
• Statistical data and market research. 

6. Program of Operations 

Include: 

• Standard terms for users, agents, and cash merchants; 
• Contracts with banks and third parties; and 
• Internal policies on IT systems, AML/CFT, accounting, complaints handling, and fund flow mechanisms. 

7. Governance and Internal Control Mechanisms 

Submit: 

• Identity and “fit and proper” forms for directors, senior managers, and shareholders; 
• Curriculum vitae, police clearance, tax PINs, credit reports; 
• Shareholding and organizational charts; 
• Internal control mechanisms for AML/CFT compliance. 

8. Safeguarding Customer Funds 

Applicants must establish a trust structure, including: 

• Trust deed and trustee appointment provisions; 
• Bank details of the trust account; 
• Mechanisms for managing dormant accounts, deceased estates, and dispute resolution; 
• Investment strategy for trust funds and usage of trust income. 

9. Risk Management and IT Audit 

Provide: 

• Risk assessment report with risk matrix; 
• IT audit report and vulnerability assessment; 
• Business Continuity and Disaster Recovery Plans; 
• Security incident response protocols; 
• Fraud prevention tools and cash transaction limits. 

 10. Access to Sensitive Payment Data 

Explain: 

• Categories of sensitive payment data handled; 
• Access control measures, encryption, and security systems; 
• Compliance with the Data Protection Act, 2019; 
• Breach detection and resolution processes; 
• Roles of personnel with access to critical data systems. 

Post-Licensing Compliance and Supervision 

Once licensed, a PSP must comply with CBK’s: 

• Ongoing supervisory framework, including periodic audits, returns, and disclosures; 
• Renewal obligations, with applications due at least two months prior to license expiry; and 
• Consumer protection standards, including data privacy, dispute resolution, and operational transparency. 

Failure to comply may result in suspension or revocation of the license under Section 15 of the NPS Regulations. 

How CM Advocates LLP Can Assist 

At CM Advocates LLP, our Financial Services & Fintech Practice Group provides end-to-end regulatory support for entities seeking to operate as PSPs in Kenya. Our services include: 

• Advising on eligibility and structuring for PSP licensing; 
• Preparing and filing comprehensive license applications to CBK; 
• Drafting trust deeds, outsourcing contracts, compliance manuals, and internal policies; 
• Advising on AML/CFT, data protection, and corporate governance frameworks; 
• Providing legal representation in regulatory matters and license renewals; 
• Supporting foreign PSPs in cross-border regulatory alignment. 

We ensure our clients meet the CBK’s exacting standards while positioning them for long-term compliance and success in Kenya’s regulated payments sector. Reach out to us at www.cmadvocates.com or commercial@cmadvocates.com  

Contributors: Maureen Odongo & Brian Thuranira