CRB Reporting for Lenders in Kenya (2026): Listing Rules, Notices and Disputes
Credit reference bureaus (CRBs) are how Kenyan lenders know who repays. They are also among the most regulated parts of lending. CBK's Non-Deposit Taking Credit Providers Regulations, 2026 (Legal Notice 191) now spell out when a lender must share data with a bureau, how much notice a borrower gets before a negative listing, which small debts can't be listed at all, and what you may and may not do with CRB data.
This guide explains those rules for credit-only lenders (digital lenders, micro lenders, logbook and asset lenders) and how to build a reporting process that's accurate, defensible and fair to borrowers.
A practical summary of Legal Notice 191, not legal advice.
Sharing data with credit reference bureaus
Regulation 33 makes two-way sharing part of lending:
- You must share. A non-deposit-taking lender shall disclose its customers' credit information to licensed credit reference bureaus.
- You may check. You may obtain a customer's credit information from a licensed bureau where you need it for your lending functions, for example to appraise an application.
- Data protection still applies. When sharing credit information, you must comply with the Data Protection Act. See data protection rules for lenders in Kenya.
CBK licenses and supervises the bureaus. Kenya currently has three, widely reported to be Metropol, TransUnion and Creditinfo. Confirm the current list with CBK before signing a data-sharing agreement.
The negative listing rules
| Rule | What regulation 33 requires |
|---|---|
| Minimum amount | No negative listing where the amount outstanding is KES 1,000 or less |
| Notice before listing | At least 30 days' notice to the customer, in writing or by recorded electronic means |
| Shorter notice | The contract may allow a shorter period, but never under 7 days for loans repaid at intervals of less than 30 days |
| Notice after listing | Tell the customer within 30 days that their information was sent to a bureau |
| Data quality | Information must be timely, complete and accurate |
| Corrections | Promptly rectify your records when told information is false or inaccurate |
Regulation 33 also protects lenders, bureaus and CBK from lawsuits over anything done in good faith under these rules. That protection is only as strong as your records, so keep proof of every notice you send.
A worked example
A borrower takes a 4-week loan with weekly installments and stops paying, leaving KES 3,200 outstanding:
- The amount is above KES 1,000, so a negative listing is possible.
- The loan is repaid at intervals of less than 30 days, so the contract may shorten the pre-listing notice, but not below 7 days.
- You send a recorded SMS notice and list after the notice period ends.
- Within 30 days of submitting, you tell the borrower they've been listed.
- If they later show they had paid, you correct the record promptly.
What you can and can't do with CRB data
Regulation 34 restricts how you use information you get from a bureau:
- Permitted uses: decisions on transactions with that customer, decisions about employees or potential employees, and other purposes authorised by law.
- No passing it on: you can't release bureau information to third parties, except where the law requires it, or to an agent you've appointed to help recover your debts.
- Keep it secure: safeguard information both received from and sent to a bureau.
Collection agents who receive CRB data are still bound by CBK's collection rules: no shaming, no contacting the borrower's phone contacts, no calls outside working hours. See debt collection rules for lenders in Kenya.
Your records are your defence
Most CRB disputes come down to records: was the borrower really late, was the amount right, was notice sent? Regulation 39 also requires lenders to:
- issue a receipt or acknowledgement for every transaction,
- give a free loan statement on request, showing principal advanced and owing, interest charged, paid and owing, the interest rate applied and all charges,
- give customers an easy way to see their loan statement at any time, including electronically,
- keep customers' financial records up to date and promptly correct errors,
- keep guarantors informed of loan performance through periodic statements.
A CRB reporting process that holds up
- Sign a data-sharing agreement with a licensed bureau and agree the submission format and frequency.
- Get consent right at onboarding. Explain in your separate consent form that credit data will be shared with bureaus.
- Keep balances accurate in real time. Match every M-Pesa repayment to its loan as it arrives, so you never list someone who has paid.
- Check the KES 1,000 threshold before any negative listing.
- Send and record the pre-listing notice: 30 days, or the contract period if shorter, but never under 7 days for short-interval loans.
- Submit timely, complete, accurate data, and send the post-listing notice within 30 days.
- Handle disputes fast. Check the loan history, correct errors promptly and confirm the correction to the bureau and the borrower.
- Restrict access to bureau reports to staff who make lending decisions, and to appointed recovery agents only when needed.
How Lendpoint helps
Accurate reporting starts with an accurate loan book. Lendpoint:
- matches M-Pesa repayments to loans automatically,
- flags overdue installments from day one,
- sends SMS confirmations when payments arrive,
- gives borrowers access to their loans and statements through the portal, app and USSD,
- keeps a full audit trail of every action.
Those records are what CRB submissions and dispute responses are built from. See Lendpoint for Kenyan lenders.
Frequently asked questions
Do lenders in Kenya have to report to CRBs?
Yes. Under regulation 33 of CBK's 2026 Non-Deposit Taking Credit Providers Regulations, credit-only lenders must disclose their customers' credit information to licensed credit reference bureaus. They may also obtain credit information from bureaus when assessing customers.
How much notice must a lender give before CRB listing?
At least 30 days, in writing or by recorded electronic means. The contract may allow a shorter period, but never less than 7 days for loans repaid at intervals under 30 days.
Can a lender list me on CRB for a small debt?
No. Non-deposit-taking lenders can't submit negative information to a bureau where the amount outstanding is KES 1,000 or less.
Can a lender share my CRB report with other people?
Only where the law requires it, or with a debt recovery agent the lender has appointed. Bureau information may only be used for decisions about the customer, employment decisions, or other purposes authorised by law.
What should a lender do if CRB information is wrong?
Promptly correct its records once told that information it submitted is false or inaccurate, and make sure the bureau receives the correction.
Which credit reference bureaus operate in Kenya?
Kenya has three CBK-licensed credit reference bureaus, widely reported to be Metropol, TransUnion and Creditinfo. Check CBK's current list before entering a data-sharing agreement.
