Background 

On 7^th August 2025, the Central Bank of Kenya (CBK) published the Draft Non-Deposit Taking Credit Providers Regulations, 2025 (the Draft Regulations) for public comment.

The Draft Regulations are issued under the Central Bank of Kenya Act (Chapter 491 of the Laws of Kenya) (CBK Act), following amendments introduced by the Business Laws (Amendment) Act, 2024. The amendments extended CBK's regulatory authority beyond Digital Credit Providers (DCPs) to encompass all non-deposit-taking credit providers (NDTCPs) in Kenya.

Our legal alert on the amendments introduced under the Business Laws (Amendment) Act 2024 can be accessed here. 

Key provisions of the Draft Regulations

(i) Scope and Applicability 

Draft Regulations apply to all non-deposit taking credit businesses not already regulated under any other written law. The Draft Regulations do not apply to:

1. Institutions licensed under the Banking Act, Microfinance Act, or Sacco Societies Act.
2. The Kenya Post Office Savings Bank.
3. Credit arrangements that are "merely incidental" to the sale of goods or services by a person whose primary business is providing those goods or services.
4. Entities whose business is regulated under any other written law or approved by the CBK.

(ii) Licensing and Registration Requirements

The Draft Regulations establish a tiered approach to licensing and registration based on an applicant’s capital base. 

• Licensing:  Applicants with an initial paid-up share capital of KES 20 million or more must  apply for a licence from the CBK. The Draft Regulations prescribe an extensive list of documents and disclosures to accompany the licence application. 
• Registration: Applicants with an initial capital below the KES 20 million threshold may apply for registration. The documents and disclosures to accompany the registration application are less extensive than for licensing. 
• Conversion of registration to a licence: A key provision in the Draft Regulations is that a registered NDTCP whose capital, borrowings, or loan book surpasses the KES 20 million threshold must convert its status to a licensed entity. The CBK may also direct a registered NDTCP to apply for a licence where the NDTCP failed to disclose the correct figures or has undergone a rapid expansion of business following its registration.

(iii) Fees

The Draft Regulations introduce an application fee of KES 100,000 for both licensing and registration. Annual fees are set at KES 500,000 for licensed entities and KES 250,000 for registered entities.

This is a steep increase from the current fees applicable under the DCP Regulations where the application fee is KES 5,000 and the annual fee is KES 20,000.

(iv) Operation of the non-deposit taking credit business 

• Obligations: The Draft Regulations introduce several key obligations for NDTCPs, including requirements to:
  • Notify CBK of any proposed changes in significant shareholding, board composition or senior management.
  • Adopt and maintain robust corporate governance standards, with clear oversight, risk management and compliance frameworks.
  • Notify CBK prior to the opening, relocation, or closing of a branch or place of business. 
  • Obtain prior written approval before introducing new products in the market or varying features of an existing product as well as for sale, transfer or amalgamation of the business. 
  • Submit reports and returns to CBK on various information including loan numbers, complaints, and non-performing loans.
  • Establish a risk management framework, a credit policy and appropriate processes and procedures to meet the objectives of the Code of Conduct provided in the Draft Regulations.
  • Obtain prior approval of CBK before voluntarily liquidating or closing the business.

• Prohibited activities: NDTCP’s are prohibited from engaging in activities such as deposit taking business; taking of cash as security for loans; collection of registration fees or membership fees from loan applicants or borrowers; foreign exchange business; payment services and transfer of funds; trust operations; and any other activity as CBK may determine.
• Place of business: the Draft Regulations introduce the requirement for NDTCPs to have at least one registered physical office in Kenya, in accordance with the requirements of the Companies Act, (Chapter 486 of the Laws of Kenya).

(v) Consumer Protection

The Draft Regulations also provide robust consumer protection obligations for NDTCPs requiring them to provide transparent transaction information, establish effective complaint resolution mechanisms, and ensure all marketing and promotional materials are fair, clear, and not misleading.  

(vi) Enforcement

The Draft Regulations grant CBK a wide range of enforcement powers over NDTCPs in the event of non-compliance. The sanctions that CBK may impose on NDTCPs for non-compliance include: 

• a monetary penalty which shall not exceed KES 2 Million, or three times the gross amount of the monetary gain made or loss avoided by the failure or refusal to comply, whichever is higher and continuing penalty not exceeding KES 10,000 in each case for each day or part thereof during which such failure or refusal continues;
• suspension or revocation of a licence or registration; 
• disqualification of a significant shareholder, director or officer from holding any position or office in any non-deposit-taking credit provider and any entity licensed by CBK for a period of five years;
• prohibition of the NDTRCP from granting new loans, undertaking the permissible activities, using specific delivery channels, borrowing new loans or engaging particular agents or service providers; or
• direct a NDTCP to take administrative or disciplinary action, suspend or dismiss from office of the non-compliant NDTCP’s director, officer, employee, agent or outsourced service provider. 

(vii) Transitional provisions

• NDTCPs will be required to apply to CBK for a licence within six months of publication of the Regulations.
• The enactment of the regulations shall repeal the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022.
• However, NDTCPs licensed under the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 shall not be affected by registration requirements under the Regulations and any pending licence applications shall at commencement of the Regulations, be processed in accordance with the Regulations. 

3) Implications of the Draft Regulations 

(a) Impact on foreign lending

The broad definitions of the terms ‘non-deposit taking credit business’ and ‘non-deposit taking credit provider’ under the CBK Act could be interpreted as placing licensing requirements for foreign lenders not established in Kenya but offering credit to borrowers in Kenya. 

This is a significant development, as foreign lending plays a significant role as a source of foreign direct investments in Kenya. 

The Draft Regulations do not provide for exemptions, thresholds or criteria for determining when the licensing or registration requirements will apply to foreign lenders not established in Kenya but provide credit facilities to borrowers including corporate borrowers and the Government in Kenya. 

In addition, the requirement under the Draft Regulations for NDTCPs to establish a physical office in Kenya further implies that foreign lenders will need to establish a physical presence in Kenya which will cause concern for foreign lenders. 

(b) Uncertainty regarding the exemption for credit arrangements incidental to the sale of goods and services

The CBK Act and the Draft Regulations exclude from their application credit arrangements that are merely incidental to the sale of goods or the provision of services. In effect, entities whose primary activity is the supply of goods or services and which only extend credit on an incidental basis are not non-deposit-taking credit providers under the CBK Act and are not subject to the licensing or registration requirements.

There is however, no guidance on the factors or criteria that CBK will apply in determining whether the provision of credit is merely ‘incidental’ to the sale of goods or provision of services. This creates uncertainty regarding the scope and application of the exemption. 

(c) The Buy-Now-Pay-Later Arrangements to be regulated under the Regulations 

The definition of a non-deposit credit business under the CBK Act  includes buy now pay later arrangements as determined by CBK.  A buy now pay later arrangement is in turn defined as an arrangement whereby the consumer purchases goods or assets, whether or not secured on the goods or assets, and pays later in instalments with or without interest. 

The inclusion of the phrase ‘as determined by CBK’ grants CBK the discretion to determine the scope of buy now pay later (BNPL) arrangements that fall within its regulatory ambit. However, the Draft Regulations provide no further guidance on which BNPL arrangements are captured and which, if any, are excluded, leaving uncertainty for market participants regarding their regulatory obligations.

(d) Registration Delays

In a press release dated 5 June 2025, the CBK noted that it had received more than 700 applications for licensing of DCPs since March 2022. As at the date of the press release, only 126 DCPs had been licensed. 

Based on the above, it remains difficult to predict how long CBK will take to process the significantly higher  volume of applications expected from NDTCPs. In addition, given the potentially large number of entities that will fall within the licensing regime and the extensive obligations imposed by the Draft Regulations, it is unclear how CBK will effectively monitor and enforce these obligations across the sector. 

4) Next Steps 

The public comment period for the Draft Regulations is open until September 5, 2025. It is crucial for the various market participants to assess the impact of the Draft Regulations on their current operations and make representations to the CBK on the Regulations.