Debt Collection Rules for Lenders in Kenya (2026): What CBK's New Regulations Allow
Kenyan lenders now have written rules for how they collect. The Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026 (Legal Notice 191, gazetted on 29 September 2026) set out what collectors may not do, how much a lender can recover on a bad loan, and how to report defaulters to credit reference bureaus (CRBs). The rules apply to every lender that takes no deposits, online or offline.
The rules cover the lender, its staff and any collection agency it hires, so they affect everyone in the collections chain. This guide explains them in plain English, with KES examples and a checklist for building a collections process that recovers money and stays within the law.
This is a practical summary of Legal Notice 191, not legal advice. Check specific cases with your advocate.
Who the collection rules apply to
The rules apply to non-deposit-taking credit providers: lenders that lend their own money and take no deposits. That covers loan apps, office-based micro lenders, logbook and asset lenders, and buy-now-pay-later providers. Banks, microfinance banks and SACCOs are regulated under their own laws. If you're not yet licensed or registered, start with how to get a CBK lending licence.
The rules bind the lender's senior officers, employees and outsourced service providers, so a lender is responsible for how its collection agents behave (regulation 30). Under regulation 31, a lender stays liable for everything an outsourced provider does and must notify CBK at least 30 days before outsourcing a material service. Lenders also can't outsource management of the loan portfolio or the final decision to lend.
12 collection practices CBK now prohibits
Regulation 30(1) prohibits lenders and their agents from:
- Threatening violence or harm to a person, their reputation or their property.
- Sending obscene or profane language to a borrower, their references or contacts to shame them.
- Accessing a borrower's phone book, contacts or phone records to message people about a late or missed payment.
- Posting a borrower's personal information online or anywhere else to shame them.
- Making unauthorised or unsolicited calls or messages to a borrower's contacts.
- Using any improper or unconscionable collection tactic.
- Any other conduct that harasses or oppresses a borrower.
- Abusing anyone in connection with collecting a debt.
- Calling a borrower or anyone else outside working hours.
- Repossessing security using violence, harassment or intimidation.
- Taking away a borrower's essential personal effects when collecting or repossessing.
- Breaching the procedures of the Auctioneers Act.
The regulations don't define "working hours". Set your own collection calling window in your credit policy, keep it to normal business hours, and make sure your dialers, SMS schedules and agents respect it.
How much you can recover on a bad loan: the in duplum cap
Regulation 29 limits what a lender can recover once a loan is non-performing. The maximum is the sum of:
- the principal owing when the loan became non-performing,
- interest under the contract, but no more than that principal, and
- reasonable expenses of recovery.
Example: a borrower owes KES 50,000 of principal when their loan becomes non-performing. However long the debt runs, you can recover at most KES 50,000 of principal plus KES 50,000 of interest, plus reasonable recovery expenses. If the borrower resumes paying and the loan later becomes non-performing again, the cap is recalculated from the date it last became non-performing. Interest under a court order that accrues after the order is outside the cap. Interest the cap doesn't allow you to recover directly can't be recovered through the courts either.
Two related rules matter just as much:
- Undisclosed charges: you can't recover any charge that wasn't disclosed in the contract signed and given to the borrower (regulation 30(2)).
- Refunds: CBK can order you to refund anything recovered above the amount owed, in breach of contract, or as undisclosed charges (regulation 30(5)).
When a loan becomes non-performing
| Loan term | Non-performing when principal or interest is still unpaid after |
|---|---|
| 30 days or less | 30 days |
| More than 30 days | 90 days |
| Any loan | Or the default period set in the loan agreement |
Regulation 57 also requires your credit policy and every loan agreement to state the default period after which a loan becomes non-performing. That date is what starts the in duplum cap, so your system needs to record it accurately for every loan.
CRB listing rules: notice, minimums and corrections
Regulation 33 requires lenders to share customer credit information with licensed credit reference bureaus, and it controls how negative listings work:
- No listing for small debts: you can't submit negative information where the amount outstanding is KES 1,000 or less.
- Notice before listing: notify the borrower in writing or by recorded electronic means at least 30 days before submitting negative information. The contract can allow a shorter period, but never less than 7 days for loans repaid at intervals under 30 days.
- Notice after listing: tell the borrower within 30 days of sending their information to a bureau.
- Accuracy: data you submit must be timely, complete and accurate, and you must promptly correct anything shown to be false or inaccurate.
Repossessing security
- Land: follow Part IX of the Land Act.
- Movable property, such as vehicles under logbook loans: follow the Movable Property Security Rights Act, and give 30 days' notice before selling the borrower's property.
- Auctions must follow the Auctioneers Act. Never use violence or intimidation, and never take essential personal effects.
Repayments and early payoff
Collections also depend on how you apply the money you collect. Regulation 56 requires lenders to:
- credit a repayment to the borrower's account on the date it is paid,
- apply repayments first to principal due, then to outstanding fees and charges, then to interest due,
- let borrowers repay early, in full or in part, without notice and without penalty, and
- charge no interest for the remaining term when a loan is repaid in full early.
Penalties for breaking the rules
Under regulation 86, CBK can impose:
- a penalty of up to KES 2 million, or three times the gain made or loss avoided, whichever is higher,
- up to KES 250,000 against the responsible senior officer, paid from their own pocket,
- up to KES 10,000 a day while a breach continues,
- directions to discipline, suspend or remove directors and officers.
Licences can also be suspended or revoked.
A compliant collections playbook
- Prevent first. Send SMS reminders before and on each due date. Most late payments are forgotten payments.
- Make paying easy. Send an M-Pesa STK push for the exact amount due, and match Paybill payments automatically so borrowers aren't chased for money they've already paid.
- Act on day one. Flag overdue installments the day after they fall due, when a polite call is cheapest and most effective.
- Charge only what the contract discloses, applied the same way to every borrower. See how to design penalties and grace periods.
- Contact only the borrower and any guarantor, during your documented working hours. Never contact their phone contacts.
- Track the non-performing date of every loan, and stop charging interest once it reaches the in duplum cap.
- Before a CRB listing, check the amount is above KES 1,000, send the 30-day notice (7 days for short loans) and keep a record of it.
- Supervise agents. Give collection agencies a written script and calling hours, notify CBK before outsourcing, and audit their calls.
- Log everything: every reminder, call, penalty, restructure and payment, so you can answer a complaint or a CBK inspection.
How Lendpoint supports compliant collections
Lendpoint handles the routine parts of this playbook automatically:
- SMS reminders before and on due dates, and confirmations when payments arrive.
- M-Pesa STK push and automatic Paybill matching.
- Overdue flags from day one.
- Penalties applied by the policy you configure.
- Loan terms and the repayment schedule fixed at approval.
- An audit trail of every action on every loan.
Lendpoint doesn't read borrowers' phone contacts. To compare tools, see our guide to loan collection software in Kenya, or see Lendpoint for Kenyan lenders.
Frequently asked questions
What debt collection practices are illegal for lenders in Kenya?
Under regulation 30 of Legal Notice 191 of 2026, lenders and their agents may not threaten, harass, abuse or shame borrowers. They may not access borrowers' phone contacts or message them, post borrowers' information online, call outside working hours, use violence or intimidation to repossess security, take essential personal effects, or breach the Auctioneers Act.
Can a lender contact my phone contacts about my loan in Kenya?
No. Lenders may not access a borrower's phone book, contacts or phone records to message people about a late or missed payment, and may not make unauthorised or unsolicited calls or messages to a borrower's contacts.
How much interest can a lender recover on a defaulted loan in Kenya?
Once a loan is non-performing, a lender can recover at most the principal owing at that point, plus contractual interest no greater than that principal, plus reasonable recovery expenses. This is the in duplum rule in regulation 29.
How much notice must a lender give before CRB listing in Kenya?
At least 30 days, in writing or by recorded electronic means. The contract can allow a shorter period, but never less than 7 days for loans repaid at intervals under 30 days. Debts of KES 1,000 or less can't be listed.
When does a loan become non-performing under the 2026 rules?
A loan of 30 days or less becomes non-performing when principal or interest is still unpaid 30 days after it falls due. A longer loan becomes non-performing after 90 days, or at the default period set in the loan agreement.
What are the penalties for breaking CBK's collection rules?
CBK can impose a penalty of up to KES 2 million or three times the gain made or loss avoided, whichever is higher, plus up to KES 250,000 against the responsible senior officer and up to KES 10,000 a day while a breach continues. It can also suspend or revoke a licence.
