Kenya's mobile lending sector grew explosively through the 2010s, mostly without meaningful regulation. By 2021, there were hundreds of digital lending apps operating in Kenya — some genuinely useful, others predatory, and some outright fraudulent. Borrowers had little protection, data was misused, and contact shaming was rampant.

The Central Bank of Kenya stepped in decisively. The CBK Amendment Act of 2021 brought digital credit providers under the CBK's licensing and supervisory framework for the first time. Since then, the regulatory landscape has changed dramatically — and for borrowers, almost entirely for the better.

This article explains what the key CBK regulations mean in practice, how they protect you as a borrower, and why platforms like SwiftCash — which operate within this framework — are the safest choice for digital borrowing in Kenya.

The Digital Credit Provider Licensing Requirement

The most fundamental change is the licensing requirement. Under regulations that came into full effect from September 2022, every entity offering digital credit in Kenya must hold a Digital Credit Provider (DCP) licence from the Central Bank of Kenya.

To obtain a DCP licence, a lender must:

  • Be incorporated as a company in Kenya
  • Have a minimum paid-up capital as specified by the CBK
  • Submit to a fit-and-proper assessment of directors and key management
  • Demonstrate compliance with Anti-Money Laundering (AML) requirements
  • Have adequate systems for data security and consumer protection
  • Operate a physical place of business in Kenya

Lenders that failed to meet these requirements were denied licences, and many foreign-owned apps that could not satisfy the Kenya-incorporation requirement were effectively shut out of the market. The CBK published lists of licensed DCPs and separately listed apps that had been denied licences or ordered to cease operations.

Consumer Protection Requirements Under CBK Regulations

The DCP framework includes specific consumer protection requirements that every licensed lender must follow. These are not optional — they are binding regulatory obligations.

Transparent Pricing Disclosure

Licensed digital lenders must disclose the full cost of a loan before the borrower accepts the offer. This means you must be shown:

  • The exact interest rate or processing fee
  • All other charges that apply
  • The total amount you will repay
  • The repayment period
  • Any penalties for late payment

This requirement ended the practice of some apps hiding charges in fine print or revealing the true cost only after the loan had been disbursed.

Fair Debt Collection Practices

The CBK regulations prohibit what became known as "contact shaming" — the practice of calling or messaging a borrower's family, friends, or employer to pressure repayment. This practice, which became notorious in Kenya's digital lending space, caused significant harm to borrowers' personal and professional relationships.

Under the current regulatory framework, licensed lenders must use only lawful debt collection methods. Harassment, threats, and third-party disclosure are explicitly prohibited.

Need quick cash? Apply on SwiftCash — get up to KES 40,000 in your M-Pesa in minutes.

Data Protection Alignment

The CBK's DCP framework works in tandem with the Kenya Data Protection Act of 2019, which requires any organisation handling personal data to collect only the data they actually need, use it only for disclosed purposes, and protect it adequately. Digital lenders must now justify every permission they request from borrowers' devices.

This regulation effectively outlawed the practice of apps requesting access to a borrower's full contact list, photos, or call logs unless they could demonstrate a legitimate need — which very few lending functions genuinely require.

CRB Reporting Obligations

Licensed digital credit providers are required to report customer repayment behaviour — both positive and negative — to Credit Reference Bureaus. This has two implications for borrowers:

  1. Consistent, timely repayment builds a positive credit history that can unlock better terms and higher limits over time.
  2. Defaults are officially recorded, which affects your ability to borrow from other licensed lenders in the future.

What the CBK Cannot Yet Fully Control: Interest Rate Caps

One area where the regulatory framework remains incomplete is interest rate caps specifically for digital lenders. While the CBK has broad supervisory authority, it has not (as of 2025) imposed a specific maximum APR on digital credit providers in the way that some consumer advocates have called for.

This means that some licensed lenders can still charge fees that translate to very high annualised rates — particularly for very short-term loans. As a borrower, you remain responsible for reading and understanding the total cost of any loan before accepting it. The disclosure requirement ensures you have the information — but the CBK does not prevent you from accepting a high-cost loan if you choose to.

How to Verify a Lender Is CBK-Licensed

The CBK publishes and regularly updates the list of licensed Digital Credit Providers on its website at www.centralbank.go.ke. To verify any lender:

  1. Go to the CBK website
  2. Navigate to Banking and Financial Institutions, then Licensed Institutions
  3. Look for the Digital Credit Providers section
  4. Search for the lender's name

If a lender is not on this list, they are not licensed, and you have no CBK-backed protection when borrowing from them. The CBK has also published separate lists of entities that applied for licences and were denied, and of entities that were ordered to stop operating. These lists are worth checking if you are unsure about a particular app.

Consequences for Unlicensed Lenders

Lending without a CBK licence is now a criminal offence in Kenya. Penalties include fines and potential imprisonment for company directors. The CBK has the authority to direct mobile money platforms (including Safaricom) to block payment channels to unlicensed lenders, effectively making it impossible for them to disburse loans or collect repayments.

This enforcement power has been used — several high-profile apps were effectively shut down when their M-Pesa Paybill numbers were blocked following CBK action.

What the Regulations Mean for Borrowers in 2025

The practical impact of Kenya's digital credit regulatory framework for borrowers in 2025 is significant:

  • You can borrow with greater confidence from licensed lenders, knowing they are subject to regulatory oversight
  • You have legal remedies if a licensed lender mistreats you — complaint mechanisms through the CBK
  • Your personal data is better protected from misuse by lending apps
  • You can see the full cost of a loan before accepting it
  • Debt collection harassment is explicitly prohibited and reportable

The market is not perfect — unlicensed apps still exist, particularly distributed via links outside the official app stores — but the licensed segment of Kenya's digital lending market is now meaningfully regulated and consumer-protective.

Borrowing Responsibly Within the Regulated Framework

Regulation makes lending safer, but it does not make borrowing automatically right for every situation. Even with a licensed lender, you should always borrow for a clear purpose, calculate the full cost of repayment before accepting a loan, and have a realistic plan to repay within the loan term.

SwiftCash operates as a licensed digital credit provider under the CBK framework, offering loans from KES 1,000 to KES 40,000 with transparent fees, no hidden charges, and funds disbursed to M-Pesa in under two minutes. Apply on SwiftCash today and borrow with the confidence that comes from a fully regulated, consumer-first lending experience.