How to Get a CBK Lending Licence in Kenya (2026): Digital and Non-Deposit-Taking Credit Providers
If you lend money in Kenya and you are not a bank, a microfinance bank or a SACCO, you now need the Central Bank of Kenya's permission, whether you lend through an app, over USSD or from an office. On 29 September 2026 CBK published the Non-Deposit-Taking Credit Providers Regulations (Legal Notice No. 191). They replace the 2022 Digital Credit Providers Regulations, raise fees sharply and add a new registration tier for smaller lenders.
This guide explains who needs a licence or registration, what it costs, how CBK's application process works and what you must keep doing once you are approved. It also covers the systems CBK expects you to have in place.
This is a practical summary, not legal advice. The 2026 rules are new, so confirm details with CBK or a licensed advocate before you apply.
Who needs a CBK licence or registration?
The Business Laws (Amendment) Act, 2024 changed the CBK Act. The old term "digital credit business" was replaced with non-deposit-taking credit business, and the law now bars anyone from carrying it on without CBK approval. It covers lenders that lend their own money and take no deposits, regardless of channel, including:
- digital and app-based loans, including USSD lending,
- loans from an office or through agents,
- asset financing and buy-now-pay-later (hire purchase is excluded),
- credit guarantee and peer-to-peer lending business.
Not covered: banks, microfinance banks and SACCOs, which are regulated under their own laws, and businesses that only give credit incidental to selling their own goods or services.
Lending without approval is an offence under section 33S of the CBK Act. Kenyan Small Claims Courts have also ruled that unlicensed lenders cannot legally enforce or recover their loans, so an unlicensed loan book is a loan book you may not be able to collect.
Licence or registration: which one do you need?
| Licence | Registration | |
|---|---|---|
| Who | Lenders starting with KES 20 million or more in capital | Smaller lenders below that level |
| When you must move up | Not applicable | Once capital, borrowings or loan book passes KES 20 million |
| Application fee | KES 100,000 | KES 100,000 |
| Annual fee | KES 500,000 | KES 250,000 |
| Paid late (within three months after 31 December) | Double: KES 1,000,000 | Double: KES 500,000 |
For comparison, under the 2022 rules the application fee was KES 5,000 and the annual fee KES 20,000. If fees are still unpaid three months after 31 December, CBK may revoke the licence.
Key dates
- 29 September 2026: the regulations take effect. Lenders licensed under the 2022 rules are treated as licensed under the new ones.
- 31 December 2026: the first annual fee falls due under the new fee schedule.
- About 29 March 2027: lenders already operating without a licence must have applied for a licence or registration within six months of publication.
- 31 March 2027: CBK must publish the names of all licensed and registered lenders.
How to apply: CBK's three-stage process
CBK's published procedure, last revised in October 2024 under the 2022 rules, sets out three stages. Expect forms and fees to be updated for the 2026 regulations, but the structure is a good guide to what CBK will ask for.
Stage 1: Approval of name (new companies only)
- Reserve at least three business names with the Registrar of Companies.
- Submit them to CBK through its online portal, in order of preference, together with:
- the name reservation document,
- shareholders' names, addresses and IDs,
- a short business summary covering the business model, delivery channels and platforms, target market, customers and products,
- the capital shareholders will inject, with evidence of the source of funds (12 months of bank statements) and the ultimate beneficial owners of any corporate shareholders,
- a source-of-funds declaration certified by an advocate or a commissioner of oaths.
- Get a letter of no objection from the Kenya Industrial Property Institute for the name.
- Incorporate a limited liability company under the approved name.
Stage 2: Application
Create an account on CBK's portal, complete the application form, and complete fit-and-proper forms for every director, the CEO, senior officers and significant shareholders. Upload them with:
- a 3–5 page business brief and evidence of capital,
- audited financial statements, if you are already trading,
- certified incorporation documents and the memorandum and articles of association of the company and of any corporate shareholders,
- a description of the ICT system you will use, with independent assurance on it,
- the terms and conditions of your credit products,
- your agreement with a telecom or other channel provider,
- AML/CFT policies, data protection policies and consumer redress procedures,
- your credit policy, code of ethics and market conduct policy, and corporate governance policy,
- your pricing model and parameters,
- for each director, significant shareholder and senior officer: a certificate of good conduct, a tax compliance certificate, and a credit reference bureau report no older than three months.
Individuals also provide CVs, certificates, ID and KRA PIN copies and a source-of-funds declaration. Corporate shareholders provide board resolutions, KRA PINs, audited accounts and their ultimate beneficiaries.
Stage 3: Data submission testing and licensing
Once CBK is satisfied with your documents, you must prove you can submit regulatory data to CBK through APIs, with CBK's guidance. After successful testing and payment of the fee, CBK issues the licence or registration and publishes your name in the Kenya Gazette and on its website.
Your obligations once you are licensed
- Credit policy: you need a written credit policy suited to your size and products.
- Product and pricing approval: you need CBK's prior written approval before launching a new product or changing its features, including interest rates. Borrowers must get at least 30 days' notice of changes, with a justification.
- Full disclosure before lending: before a loan is taken, show the amount, interest, all fees, repayment dates, total cost of credit, the APR and how to complain, clearly. Give the borrower their loan agreement when they sign.
- Marketing opt-out: borrowers must be able to stop marketing messages, including after their loan is repaid.
- Restructuring: restructure loans according to your credit policy, on request or with prior notice.
- AI and automated decisions (regulation 60): if you use AI to decide on loans, you must be able to explain the decision to the customer, tell them when they are dealing with a machine, keep human oversight, and guard against biased outcomes.
- Data protection: comply with the Data Protection Act, 2019 and register with the Office of the Data Protection Commissioner where required.
- App stores: Google Play only lists Kenyan loan apps from lenders that appear in CBK's directory.
What your lending system needs to support
CBK asks about your systems at application and expects them to support your obligations afterwards. Before you choose software, check that it can:
| CBK expectation | What to look for in your system |
|---|---|
| Description of your ICT system, with independent assurance | A vendor that can document its architecture, security and data isolation for your application and your assurance provider |
| Pricing model and approved products | Products configured once, with interest, fees and the schedule fixed at approval, so staff can't change pricing loan by loan |
| Full cost disclosure to borrowers | Total repayment, fees and due dates calculated by the system and sent to the borrower |
| Explainable credit decisions | Clear, rule-based eligibility, such as score thresholds, loan limits and amount ranges, that staff can explain |
| Regulatory data submission | Clean, exportable loan-level data. Ask how the vendor supports CBK's reporting APIs. |
| Fair collections and complaints | Automated reminders, policy-driven penalties and a full audit trail of every action on a loan |
| Data protection | Role-based access, data isolated from other customers, and no unnecessary data collection |
Lendpoint is built for Kenyan lenders. Products, interest and fees are configured once and fixed at approval, eligibility uses credit scores and loan limits you set, disbursement and repayment run through M-Pesa, and every action is logged. Each lender's data is kept in its own isolated database. See Lendpoint for digital lenders.
Common reasons applications are delayed
- Unclear source of funds: missing bank statements or undeclared beneficial owners.
- Incomplete fit-and-proper forms: missing CRB reports, good conduct certificates or tax compliance certificates for one director or shareholder.
- Generic policies: credit, AML or data protection documents copied from templates that don't match your actual products.
- Systems you can't describe: no documentation of how loans, data and security are handled, or a failed data submission test.
- Pricing that doesn't match the product terms you submitted.
Frequently asked questions
How much does a CBK lending licence cost in Kenya?
Under the 2026 regulations the application fee is KES 100,000. The annual fee is KES 500,000 for a licence and KES 250,000 for a registration, payable by 31 December each year. Late payment doubles the fee.
Do I need a licence or a registration?
Lenders starting with KES 20 million or more in capital need a licence. Smaller lenders register, and must apply for a licence once their capital, borrowings or loan book passes KES 20 million.
Do I need a CBK licence if I don't lend through an app?
Yes. Since the Business Laws (Amendment) Act, 2024, the requirement covers non-deposit-taking credit business through any channel, not only digital lending. Banks, microfinance banks and SACCOs are regulated separately.
How long does CBK take to approve a licence?
Timelines depend mainly on how complete your application is and on passing data submission testing. Incomplete fit-and-proper documents and unclear source of funds are the most common causes of delay.
How many licensed digital lenders are there in Kenya?
CBK's directory had 281 entries by the end of September 2026, after CBK received more than 900 applications since March 2022. By August 2026 licensed lenders had issued about 9.6 million loans worth KES 165.1 billion.
What happens if I keep lending without a licence?
It is an offence under the CBK Act. Courts have also held that unlicensed lenders cannot legally enforce their loans. Lenders already operating have until about late March 2027 to apply.
