How CBK's Digital Credit Provider Licence Is Cleaning Up Kenya's Lending Industry

For most of the 2010s, Kenya's digital lending market operated in a regulatory vacuum. Anyone with a mobile app and access to capital could lend money to Kenyans at any rate they chose, with any collection practices they found effective, and with no obligation to protect borrower data or provide a fair complaints mechanism. The results were predictable: a wave of predatory lenders, ballooning consumer debt, and widespread CRB listings that blocked millions of Kenyans from accessing formal finance.

The Banking (Amendment) Act 2021 changed that. By requiring all digital credit providers to obtain a licence from the Central Bank of Kenya (CBK), Kenya joined a small group of African countries that have brought fintech lending under meaningful regulatory oversight. The impact has been significant — and largely positive for borrowers.

What the DCP Licence Requires

The CBK's Digital Credit Provider (DCP) licence is not a rubber stamp. Applicants must demonstrate:

• Minimum capital: A prescribed minimum capital threshold to ensure the lender can absorb losses without collapsing mid-operation
• Fit and proper management: Directors and senior management must pass background checks; convicted fraudsters cannot run licensed lenders
• Transparent pricing: The full cost of credit must be disclosed before the borrower commits
• Complaints mechanism: Licensed lenders must have a functional process for borrowers to raise and resolve disputes
• Data protection compliance: Lenders must comply with Kenya's Data Protection Act 2019, including limiting data collection to what is necessary
• Responsible CRB reporting: Borrowers must be notified before being listed, and listings must be accurate and timely

What Is Now Banned

The DCP licensing framework effectively banned a set of practices that had become disturbingly common in Kenya's mobile lending market. These include:

• Accessing a borrower's contacts to shame them or their family members into repayment
• Sharing a borrower's data with third parties without consent
• Using intimidation, threats, or public shaming as collection tactics
• Charging undisclosed fees or changing loan terms after the fact
• Listing borrowers on CRBs without prior notice or for amounts under the threshold prescribed by CRB regulations

These are not merely guidelines — violating them can result in licence revocation, fines, and criminal prosecution. For lenders who previously relied on contact-shaming as their primary collection method, the business model collapsed overnight.

The CBK's Licensing Process in Practice

When the CBK opened the licensing window in 2022, it received applications from well over 400 digital lenders. The review process was thorough: CBK examiners scrutinised each applicant's ownership structure, financial position, governance arrangements, and compliance frameworks. Many applicants were asked to resubmit with additional documentation or to meet conditions before receiving a licence.

The first tranche of 32 licences was announced in mid-2022, with additional approvals following in subsequent tranches. The CBK has continued to review applications and publish updated lists of licensed providers on its website.

Lenders that applied but did not meet the standards were declined. Lenders that did not apply were, by definition, operating illegally after the deadline and were instructed to cease offering new loans.

How Borrower Complaints Are Now Handled

Before the DCP framework, a borrower who felt wronged by a digital lender had almost no formal recourse. You could call a customer service line (if one existed), post on social media, or do nothing. The CBK provided no mechanism for complaints about non-bank lenders.

Under the new framework:

1. Licensed lenders must have an internal complaints mechanism with defined response times
2. If the internal mechanism fails, borrowers can escalate to the CBK's consumer protection department
3. The CBK can compel a licensed lender to resolve a legitimate complaint or face sanctions
4. For data violations, borrowers can additionally approach the Office of the Data Protection Commissioner (ODPC)

This is a material change from the previous environment where borrowers had no escalation path beyond helplessness.

CRB Reform: A Separate but Connected Piece

The DCP licensing framework intersects with reforms to how credit reference bureaus operate. The Credit Information Sharing (CIS) framework now requires that:

• Borrowers receive notice before being listed as non-performing
• Lenders cannot list borrowers for loans below a de minimis threshold (currently KES 1,000 for individuals)
• Borrowers can access their CRB report once per year for free
• Incorrect listings must be corrected within defined timelines after a dispute is raised

The era of being CRB-listed for a KES 50 M-Shwari balance — which affected hundreds of thousands of Kenyans and was the subject of intense public debate — should be over under these rules.

What Has Actually Changed for Borrowers?

The honest assessment is: a lot has improved, but the market is still not perfect. Interest rates remain high across the industry — the CBK has not imposed a rate cap on digital lenders the way it briefly imposed one on bank lending. The argument is that rate caps reduce credit availability; the counter-argument is that 400% APR is not genuinely "credit" in any meaningful sense.

What has concretely improved is the elimination of the most abusive practices. Contact-shaming, which caused documented cases of borrowers losing jobs and experiencing family breakdown, has been driven underground by licensed lenders. Data protection expectations have raised the floor on how borrower information is handled. The complaints mechanism gives borrowers a voice they previously lacked.

How to Check If Your Lender Is Licensed

The CBK publishes a current list of licensed digital credit providers at cbk.go.ke. If your loan app is not on that list, it is operating outside the regulatory framework, regardless of how professional its app looks or how many five-star reviews it has on Google Play.

SwiftCash operates within the regulatory framework that the CBK has established — transparent fee disclosure, no contact-shaming, and a proper complaints process. When you borrow from a licensed lender, you are not just getting credit; you are getting the protections that Kenyan law now guarantees you. That distinction is worth paying attention to before you apply for any mobile loan.

The Bigger Picture

Kenya's DCP licensing framework has positioned the country as a model for fintech regulation on the continent. Other African markets are watching closely, and several have cited Kenya's approach when designing their own frameworks. The core insight — that mobile lending is too important and too widespread to leave unregulated, but that heavy-handed rate caps stifle innovation — has produced a middle path that most regulators around the world are still struggling to find.

For Kenyan borrowers, the message is simple: the regulatory environment has genuinely improved. Use it. Borrow from licensed lenders, know your rights, and report lenders who violate them.