Before 2022, Kenya's mobile lending market was largely unregulated. Hundreds of apps operated freely, charging triple-digit annual interest rates, harvesting borrower data without consent, and shaming defaulters by contacting their phone contacts. That era is over — at least in law, if not entirely in practice.

The Central Bank of Kenya (CBK) now regulates digital credit providers under a comprehensive licensing framework. Understanding what these regulations require helps you know what protections you have as a borrower, and helps you identify lenders who are violating the rules.

The Legal Foundation: CBK (Amendment) Act 2021

The Central Bank of Kenya (Amendment) Act 2021 gave the CBK explicit authority to regulate digital credit providers for the first time. Before this amendment, mobile lenders operated under a legal grey area — they were not banks, so they fell outside the Banking Act, and there was no specific digital lending legislation.

The Amendment Act changed this by:

  • Defining "digital credit providers" as entities that use digital channels to offer credit facilities
  • Requiring all DCPs to obtain a CBK licence before operating
  • Giving the CBK power to set conduct rules, revoke licences, and impose sanctions
  • Establishing consumer protection standards as a core licensing requirement

The CBK began accepting licence applications in March 2022 and set a deadline for all existing digital lenders to apply. Unlicensed operation after the deadline became illegal.

The DCP Licensing Requirements

To obtain a Digital Credit Provider (DCP) licence from the CBK, a lender must satisfy a rigorous set of requirements. These include:

Capital Requirements

Digital credit providers must demonstrate adequate capital to operate. The minimum capital requirement ensures lenders have real financial substance — not just a loan app and a payment gateway.

Fit and Proper Criteria

Directors and senior management of DCP applicants must meet the CBK's fit and proper criteria. This means individuals with criminal histories or records of financial misconduct cannot control licensed digital lenders.

Technology and Data Security

Applicants must demonstrate robust IT systems, cybersecurity protocols, and data protection measures consistent with Kenya's Data Protection Act 2019. This directly impacts how your personal data is handled.

Consumer Protection Framework

Lenders must have clear complaint handling procedures, transparent pricing, and fair collection practices before a licence is granted.

What CBK Regulations Require Lenders to Do

For licensed digital lenders in 2025, CBK regulations impose specific conduct obligations that directly benefit borrowers:

Full Pricing Disclosure

Licensed lenders must disclose the full cost of credit — including the Annual Percentage Rate (APR), all fees, and the total repayment amount — before a borrower accepts a loan. Burying fees in fine print or disclosing them only after acceptance violates this requirement.

Responsible Lending Assessment

Lenders are required to assess a borrower's ability to repay before extending credit. This is meant to prevent the predatory practice of extending credit to borrowers who demonstrably cannot repay, trapping them in debt cycles.

Fair Debt Collection

The CBK's conduct rules prohibit abusive collection practices. Specifically, contacting a borrower's phone contacts — a tactic widely used by unregulated apps before 2022 — is prohibited. Collection efforts must be directed at the borrower, not third parties.

Data Protection Compliance

All licensed DCPs must comply with the Data Protection Act 2019, regulated by the Office of the Data Protection Commissioner (ODPC). This means lenders must:

  • Obtain explicit consent before collecting personal data
  • Only collect data necessary for their stated purpose
  • Not share data with third parties without consent
  • Allow borrowers to access and request correction of their data

Looking for a safe, CBK-compliant mobile loan? SwiftCash is a legitimate digital lender offering KES 1,000–40,000 with transparent fees — no upfront payments before disbursement, no hidden charges.

Borrow Safely with SwiftCash

CRB Reporting Rules

The relationship between digital lenders and Credit Reference Bureaus (CRBs) is also regulated. Licensed DCPs are required to:

  • Report accurate borrower data to licensed CRBs
  • Report both positive repayment history and defaults — not just negative data
  • Follow the Credit Reference Bureau Regulations when listing negative information
  • Notify borrowers before listing them as defaulters

If a lender lists you as a defaulter on CRB without proper notification, or reports inaccurate data, you have the right to dispute it through the CRB's formal dispute resolution process.

The CBK's Enforcement Actions in 2022–2024

The CBK has not been passive in enforcing its licensing regime. Following the application deadline, hundreds of lenders who failed to obtain licences were effectively required to cease operations. The CBK published lists of licensed DCPs, making it straightforward for the public to identify compliant lenders.

Several previously prominent mobile lending apps were not among the licensed providers — either because they did not apply, failed to meet requirements, or were denied. This reshaped the market significantly, removing the worst-offending predatory lenders from the regulated space.

What CBK Regulations Do Not Cover (Yet)

It is important to understand the limits of CBK regulation. Not all consumer protection gaps have been addressed:

  • Interest rate caps: Unlike commercial banks, digital lenders are not subject to a statutory interest rate cap as of 2025. Lenders must disclose rates, but there is no ceiling on what they can charge
  • Unlicensed operators: Regulations only protect you if you borrow from a licensed lender. Scammers and unlicensed operators fall outside the CBK's jurisdiction
  • Cross-border lenders: Some apps operating from outside Kenya may not be captured by the DCP framework

How to Use This Knowledge as a Borrower

Understanding CBK regulations gives you a practical framework for evaluating any lender:

What CBK Requires How to Verify the Lender Complies
DCP licence Check CBK website list of licensed DCPs
Full pricing disclosure All fees visible before you accept the loan
No abusive collection Collections directed only at you, not your contacts
Data protection compliance Privacy policy references the Data Protection Act 2019
CRB reporting Lender confirms it reports to licensed CRBs

A lender like SwiftCash meets these regulatory standards — transparent fee disclosure, direct M-Pesa disbursement, no pre-disbursement payments, and clear terms that comply with CBK requirements. When comparing options, use the CBK framework as your baseline: any lender who cannot demonstrate compliance with it should not receive your business.

The regulatory environment for mobile lending in Kenya in 2025 is significantly stronger than it was three years ago. The CBK's licensing regime has raised the floor for consumer protection. But regulations only protect you if you borrow from licensed providers — which is why verifying a lender's CBK status remains the single most important step any Kenyan borrower can take.