Central Bank of Kenya plans to license non-bank financial institutions with loan portfolios surpassing USD 155,000
The Central Bank of Kenya (CBK) has proposed new regulations, titled the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2025, aiming to bring all non-deposit-taking lenders under its direct regulatory control for the first time[1][5].
These regulations apply to non-deposit taking credit providers (NDTCPs), replacing the previous term "Digital Credit Providers" to more comprehensively cover the market[1][5]. Any credit-only provider with at least KES 20 million (about $155,000) in capital, borrowings, or loan book must obtain a CBK license to operate legally[2][3].
Smaller entities below this threshold must still register with CBK, establishing a two-tier regulatory framework[3]. The new regulations target a broad range of lenders outside traditional banking regulation, including buy-now-pay-later firms, hire purchase companies, credit guarantors, peer-to-peer platforms, and pay-as-you-go lenders[3].
Licensed credit-only providers must comply with stringent requirements including detailed disclosure of corporate and ownership information, source of capital verification, consumer protection policies, anti-money laundering controls, pricing models, lending practices, technology and data security measures, credit risk management policies, and complaint handling processes[3].
The draft regulations aim to close existing regulatory gaps that have allowed unethical practices like excessive interest rates, aggressive debt collection, and data privacy breaches to persist in the credit market. These regulations follow amendments to the CBK Act under the Business Laws (Amendment) Act, 2024, reflecting the CBK’s goal to create a secure, resilient, and inclusive financial ecosystem in Kenya[1][5].
The public consultation on these draft regulations is open until September 5, 2025, after which affected entities will have six months to comply once the regulations are formally gazetted[1][3]. Firms that cross the KES 20 million threshold must convert their registration into a full license. Lenders must sign and follow a code of conduct covering fairness and transparency. The new regulations aim to standardize consumer protections across all credit-only providers[3].
The CBK's mandate is expanded through the Business Laws (Amendment) Act 2024, part of Governor Kamau Thugge's push for consistency in the sector. The new regulations are designed to close regulatory gaps and bring non-deposit-taking lenders under CBK’s direct control for the first time[1][5]. The Central Bank of Kenya (CBK) will not require existing licensed digital credit providers (126) to reapply.
The new regime will set baseline standards for lending operations, price loans, handle customer data, and resolve complaints. CBK will monitor for under-reporting of capital and can compel a fast upgrade if it sees rapid growth or incomplete disclosures[1][5]. The regulations will affect lenders operating outside CBK oversight, including buy-now-pay-later firms, hire purchase businesses, credit guarantors, peer-to-peer platforms, and pay-as-you-go operators.
The Central Bank of Kenya's new regulations, titled the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2025, aim to bring non-deposit-taking lenders under its direct control and address unethical practices in the credit market, such as excessive interest rates and data privacy breaches. These regulations will impact various businesses, including buy-now-pay-later firms, hire purchase companies, credit guarantors, peer-to-peer platforms, and pay-as-you-go lenders. The rules require credit-only providers to follow stringent requirements, including technology and data security measures and consumer protection policies, as part of a two-tier regulatory framework encompassing both licensed and registered entities.
