How CBK's Digital Credit Provider Licence Is Cleaning Up Kenya's Lending Industry

Before September 2022, Kenya's mobile lending market was a free-for-all. Dozens of apps operated without any regulatory oversight, deploying tactics that would be illegal in most countries: accessing your entire contact list to threaten friends and family if you missed a payment, charging effective interest rates above 400% per year, adding undisclosed fees after disbursement, and listing borrowers on Credit Reference Bureaus for amounts as small as KES 100. The damage to ordinary Kenyans was significant — and well documented by the Central Bank of Kenya, consumer rights organisations, and investigative journalists.

The Central Bank of Kenya (Amendment) Act 2021 changed all of that. By bringing digital credit providers under CBK's direct supervision for the first time, Kenya established one of the most comprehensive mobile lending regulatory frameworks in Africa. Three years on, the industry looks meaningfully different — though enforcement gaps remain.

Why Regulation Was Urgently Needed

The 2018–2021 period represented the worst of Kenya's unregulated mobile lending era. Key documented abuses included:

• Contact shaming — apps like OKash, Okash, and several others accessed borrowers' full phone contact lists and sent threatening or humiliating messages to contacts if repayment was late. The CBK received hundreds of formal complaints about this practice.
• Predatory rates — some apps charged facility fees, roll-over fees, and late fees that compounded to effective annual rates of 200–600%, with none of these costs disclosed upfront in plain language.
• Aggressive CRB listing — unregulated lenders listed borrowers on Credit Reference Bureaus for tiny amounts, sometimes even for amounts already repaid, creating widespread CRB blacklisting that locked millions of Kenyans out of formal credit.
• No grievance mechanism — borrowers had nowhere to complain. The apps were not licensed by any regulator, so CBK, the Communications Authority, and the Office of the Data Protection Commissioner all disclaimed jurisdiction.
• Privacy violations — several apps collected and stored far more personal data than needed for lending, including precise location data, browsing history, and SMS message content, with no clear data protection policies.

By 2021, a CBK survey found that over 14 million Kenyans — roughly a quarter of the adult population — had been negatively listed on CRBs, the vast majority through mobile loan defaults. The social and economic cost was enormous.

What the DCP Licensing Regime Requires

The CBK (Amendment) Act 2021 gave CBK authority to license, regulate, and supervise all digital credit providers. The DCP licensing application process, which opened in March 2022 with a September 2022 deadline for existing operators, required applicants to demonstrate compliance across several dimensions:

Minimum Capital Requirements

DCPs must maintain minimum capital of KES 3 million — ensuring they are genuine businesses rather than fly-by-night operations. This requirement alone eliminated many smaller predatory apps.

Transparent Fee Disclosure

Licensed DCPs must disclose all fees, interest rates, and charges before a borrower accepts a loan. The total cost of credit must be expressed in both percentage and absolute shilling terms. Hidden fees added after disbursement are prohibited.

Data Protection Compliance

DCPs must comply with Kenya's Data Protection Act 2019. Critically, accessing a borrower's contact list — let alone using it to send collection messages to third parties — is now explicitly prohibited unless the borrower gives specific informed consent. Most legitimate lenders have abandoned contact-list scraping entirely.

Fair Collection Practices

Contact shaming, threats, harassment, and disclosure of loan information to third parties without the borrower's consent are prohibited. DCPs must have a formal, documented collection process that complies with the fair lending standards CBK has published.

CRB Reporting Rules

The old regime where any default could trigger a CRB listing has been reformed. Under the DCP framework, licensed lenders must follow CBK's CRB reporting guidelines, which include minimum thresholds for listing and requirements to notify borrowers before reporting negatively. The threshold for CRB listing was raised, and the rules for CRB delisting were clarified.

Grievance Mechanism

Every licensed DCP must have a formal customer complaints process and must report complaint data to CBK. Borrowers can escalate unresolved complaints directly to CBK — giving them actual regulatory recourse for the first time.

Anti-Money Laundering and Know Your Customer

DCPs must implement AML/CFT (Anti-Money Laundering and Counter-Financing of Terrorism) programmes, including KYC verification of all borrowers. This has standardised onboarding practices and reduced the anonymity that some predatory lenders exploited.

Who Got Licensed — and Who Did Not

The September 2022 deadline produced a dramatic thinning of the market. Of over 700 digital lending apps estimated to be operating in Kenya before the deadline, CBK had licensed fewer than 30 providers in the initial round by late 2023, with additional applications pending review.

Among those licensed by CBK are operators including Branch International, Tala (Mkopo Rahisi), and several others who met the capital and compliance requirements. The exact CBK-approved list is publicly available on the CBK website and is updated periodically.

Many apps that were notorious for abusive practices failed to apply or failed to meet the standards — and effectively exited the market. The apps that remain include genuine, compliant operators committed to fair lending.

What Changed for Borrowers in Practice

The practical impact for ordinary Kenyans has been significant, though not uniform:

Reduced Contact Harassment

The volume of complaints about contact-list shaming dropped substantially after September 2022. This was the single most widely reported abuse, and its near-elimination is the regulation's most visible consumer win.

Clearer Loan Terms

Loan apps from licensed providers now display total cost of credit, repayment dates, and fees far more clearly than before. While some operators still present these in ways that require careful reading, the worst opacity has been cleaned up.

Better CRB Outcomes

CBK's intervention in CRB reporting rules — including requiring lenders to follow proper notification processes before listing — has started to reduce the volume of unjustified negative listings. However, the backlog of historical incorrect listings remains a live problem.

Recourse When Things Go Wrong

Borrowers with legitimate complaints against licensed DCPs now have a clear path: exhaust the lender's internal complaints process, then escalate to CBK. This formal recourse mechanism did not exist before 2022.

Remaining Gaps and Enforcement Challenges

Honest assessment requires acknowledging what the licensing regime has not yet fixed:

Unlicensed Apps Still Operating

Despite CBK's clear directive that all digital lenders must be licensed, some unlicensed apps continue to operate — available on Google Play Store and Apple App Store — targeting Kenyans who do not know how to check licence status. The enforcement challenge is that app stores operate globally and CBK's jurisdiction does not extend to removing apps from international app store platforms.

High Rates Remain Legal

The DCP licensing regime does not cap interest rates. Licensed lenders can still charge rates that, in annual terms, run to 150–300%. The CBK's position has been that full transparency about rates is the regulatory priority, not rate caps — a position that has frustrated consumer rights advocates who argue that transparency alone does not prevent exploitation of borrowers with no alternatives.

Enforcement Speed

CBK has limited field enforcement capacity. Monitoring compliance across dozens of licensed DCPs and hundreds of unlicensed operators simultaneously is resource-intensive, and investigations move slowly.

Data Protection Overlap

Jurisdiction between CBK (financial regulation) and the Office of the Data Protection Commissioner (data privacy) is still being worked out. Some data-related lending abuses fall in grey areas between the two regulators' mandates.

How to Verify a Lender Is Licensed

Checking whether a mobile lender holds a valid CBK Digital Credit Provider licence is straightforward:

1. Visit the CBK website at cbk.go.ke.
2. Navigate to "Bank Supervision" or use the site search for "Digital Credit Providers."
3. CBK publishes the current list of licensed DCPs, which is periodically updated.
4. If a lender is not on this list, do not borrow from them — regardless of how attractive their terms appear.

The Bigger Picture

Kenya's DCP licensing framework is, by African standards, an impressive regulatory achievement. The willingness to move decisively against a large, established industry — delisting hundreds of apps and holding the remainder to clear standards — demonstrated genuine regulatory resolve.

The work is not finished. Rate transparency without rate fairness is only half a solution. Enforcement against unlicensed operators needs more resources. And the millions of Kenyans carrying historical negative CRB listings from the pre-regulation era still need a pathway to clearing those records.

But for borrowers today, the landscape is meaningfully safer than it was in 2021. Choosing a licensed DCP — one that discloses its fees clearly, does not access your contacts, and has a proper complaints process — is now a realistic and achievable standard. SwiftCash operates within this regulated framework, offering transparent loans up to KES 40,000 with clear fee disclosure, M-Pesa disbursement in under 2 minutes, and fair collection practices that respect your privacy and your contacts.