Licensing · Regulation · AML compliance
Fintech and Financial Services Regulation in Kenya
Whether you need a licence in Kenya, which regulator issues it, and what it takes to keep it are three separate questions. We answer all three before you build the product around an assumption.
Licences, regulators and compliance mandates
- Payment service provider (PSP) licensing
- Payment gateways and merchant acquiring
- Digital and non-deposit-taking lending
- Virtual assets and VASP licensing
- Banking and banking-as-a-service
- Capital markets licensing
- Insurance and insurtech
and 5 further areas set out below
Kenya regulates financial services by activity, not by label. Calling a business a fintech tells you nothing about which licence it needs — the same product can fall to the Central Bank of Kenya, the Capital Markets Authority, the Insurance Regulatory Authority or SASRA depending on how it is structured, and some products need more than one authorisation.
That distinction has become sharper. The Virtual Asset Service Providers Act, 2025 commenced on 4 November 2025 and the regulations under it split supervision between the CBK and the CMA by activity, with a transition deadline of 4 November 2026 for firms already operating. Separately, the CBK has licensed 252 digital credit providers since the framework opened in March 2022, from more than 800 applications — a licensing rate that reflects how much of the assessment turns on governance, AML systems and source of funds rather than on the lending model itself.
We act on authorisation applications, on regulatory engagement when something has gone wrong, and on the structuring decisions taken before either — which is usually where the outcome is determined. If your product does not need a licence, we would rather tell you that at the start than build a compliance programme around a permission you do not require.
Areas of work
Licences, regulators and compliance mandates
Payment service provider (PSP) licensing
Authorisation under the National Payment System Act, 2011 and its 2014 Regulations, across the CBK's categories — electronic retail payment service provider, payment instrument issuer, e-money issuer and small e-money issuer. Choosing the right category is the first substantive decision.
Payment gateways and merchant acquiring
Structuring for gateways, aggregators and acquirers, including where the regulated activity actually sits when a business partners with an already-licensed provider rather than licensing itself.
Digital and non-deposit-taking lending
Licensing and ongoing compliance under the CBK (Digital Credit Providers) Regulations, 2022 — covering pricing disclosure, debt collection conduct, data protection and AML. The draft Non-Deposit Taking Credit Providers Regulations, 2025 would widen this to lenders operating offline as well.
Virtual assets and VASP licensing
Authorisation under the Virtual Asset Service Providers Act, 2025 for exchanges, wallet providers, brokers, token issuers and stablecoin issuers, including which of the CBK or the CMA is your regulator and whether you need both.
Banking and banking-as-a-service
Advice under the Banking Act for banks and for fintechs distributing regulated products through a bank partner, where the sponsor arrangement determines who carries the regulatory obligation.
ExploreCapital markets licensing
CMA authorisation for fund managers, investment advisers, collective investment schemes and online forex brokers, together with the ongoing reporting and capital adequacy obligations that follow the licence.
ExploreInsurance and insurtech
IRA authorisation and product approval for insurers, brokers and digital distribution models, including embedded insurance sold alongside a non-insurance product.
SACCOs and cooperative finance
Advice for deposit-taking and non-deposit-taking SACCOs regulated by SASRA — governance, member lending, capital requirements and the digital channels increasingly used to deliver services.
AML, CFT and KYC programmes
Anti-money laundering frameworks under POCAMLA: risk assessment, customer due diligence, transaction monitoring, reporting to the Financial Reporting Centre and staff training. This is consistently the area where licence applications are held up.
ExploreData protection for financial services
Compliance with the Data Protection Act, 2019 in a lending and payments context — consent, credit reference reporting, and the debt collection practices that have attracted the ODPC's largest penalties to date.
Regulatory engagement and investigations
Representation when a regulator raises a concern: information requests, remediation undertakings, directions and enforcement. Early engagement generally produces a materially better outcome than a defensive one.
ExploreCross-border and regional expansion
Market entry for foreign financial institutions and expansion by Kenyan firms into the region, including which activities can be conducted from Kenya and which require local authorisation elsewhere.
ExploreThe law that applies
The framework that decides your licence
Kenyan financial services regulation is spread across several statutes and four principal regulators. These are the instruments that most often determine whether an activity is licensable and by whom. Positions in this area change frequently and were reviewed on the date shown below.
Virtual Asset Service Providers Act, 2025
Kenya's first dedicated virtual asset licensing regime. Supervision is split by activity: the CBK takes wallet custody, payment processing and stablecoin issuance, while the CMA takes exchanges, brokerage, investment advice, asset management, token offerings and tokenisation. A business spanning both may require more than one licence.
Commenced 4 November 2025. The Regulations set a transition deadline of 4 November 2026, and impose a minimum capital requirement of KES 300 million on stablecoin issuers, with no minimum for virtual asset investment advisers.
National Payment System Act, 2011 and National Payment System Regulations, 2014
The basis on which the CBK licenses and supervises payment service providers. Any business offering electronic payment processing, mobile money, digital wallets or merchant acquiring to Kenyan users needs an authorisation under this framework, in the category that matches what it actually does.
Central Bank of Kenya (Digital Credit Providers) Regulations, 2022
Governs licensing and conduct for digital lenders, covering pricing transparency, debt collection practices, data use and AML obligations. The CBK has licensed 252 providers as at July 2026 from over 800 applications received since March 2022 — most failures turn on governance, AML systems and source of funds.
The draft Non-Deposit Taking Credit Providers Regulations, 2025 would repeal and replace these, extending the regime to offline lenders following the Business Laws (Amendment) Act, 2024. They remain in draft.
Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) and the Financial Reporting Centre
Imposes customer due diligence, record-keeping, transaction monitoring and suspicious transaction reporting obligations on reporting institutions, including most licensed financial businesses. In practice the AML programme is assessed as part of the licence application, not after it.
Capital Markets Act (Cap 485A)
Governs CMA licensing of fund managers, investment advisers, collective investment schemes, online forex brokers and dealers, together with continuing obligations on capital adequacy, client asset segregation and reporting.
Data Protection Act, 2019
Applies across lending and payments — to credit scoring, credit reference reporting and debt collection in particular. The Office of the Data Protection Commissioner has issued penalty notices in this sector, including a KES 2.975 million penalty against a digital lender for using third-party contacts in debt collection.
Administrative penalties under section 63 are capped at KES 5 million or 1% of annual turnover, whichever is lower.
This page describes the legal framework in general terms and is not legal advice. Legislation and regulator practice change; the position below was reviewed on 26 August 2026. Advice on your own circumstances requires an engagement with the firm.
Who we act for
Who we act for in regulated financial services
Payment companies and fintechs
Building a payments, wallet or remittance product and needing to know which CBK category applies, or whether partnering with a licensed provider avoids the need to license at all.
Digital lenders
Applying for a CBK licence, or already licensed and dealing with pricing disclosure, collection conduct or data protection compliance.
Virtual asset businesses
Operating an exchange, wallet, brokerage or token product in Kenya and needing to be authorised before the transition period under the VASP framework closes.
Fund managers and investment advisers
Seeking CMA authorisation, launching a collective investment scheme, or restructuring an existing licence to accommodate a new product.
SACCOs and cooperatives
Regulated by SASRA and managing governance, capital or member-lending issues, or digitising delivery of member services.
Foreign financial institutions
Entering Kenya as a regulated business, and needing the licensing route, the local entity structure and the substance requirements mapped before committing.
Find out which licence you actually need
Describe the product and how money moves through it. We will tell you whether it is licensable in Kenya, which regulator it falls to, and what the realistic route to authorisation looks like.
How we work
How a licensing instruction runs
- 01
Perimeter assessment
We establish whether the activity is licensable at all, which regulator it falls to, and whether a partnership with a licensed entity is a legitimate alternative to applying.
- 02
Structuring
Entity, shareholding, capital and governance arranged to meet the licence conditions — including fitness and propriety for directors and significant shareholders, which is assessed on individuals, not just the company.
- 03
Application and policy suite
Preparation and filing of the application with the supporting documentation regulators actually test: business plan, AML programme, risk framework, data protection position and IT controls.
- 04
Engagement to grant, then ongoing compliance
Handling regulator queries through to determination, then the reporting calendar, variations and notifications that keep the licence in good standing afterwards.
Legal insights
Further reading on fintech & financial services
- Banking & FinanceBanking Regulation in Kenya: What the CBK Expects From Licensed InstitutionsCBK enforcement has shifted from capital to governance and AML. Institutions still resourcing for the old priorities are exposed.
- Corporate LawUpper Hill: Legal Support for Kenya's Banking and Institutional SectorUpper Hill runs on documentation that must be right the first time. Security registered late is security that ranks behind someone else.
- Banking & FinanceKenyan Loan Agreements: The Security That Actually Gets EnforcedSecurity not registered within the statutory window is void against a liquidator. The window is short and unforgiving.
Common questions
Questions we are asked most
Related Gracen Law Services
Work that sits alongside fintech & financial services
Most matters in this area touch at least one of the following. Each links through to the relevant Gracen Law practice or sector page.
- Banking, Finance, Fintech & SaccosCapital, compliance, and financial innovation structured with confidence.
- Regulatory & ComplianceDecisions that withstand regulatory and stakeholder scrutiny.
- Corporate LawOwnership, capital, and governance structured for long-term value.
- Financial Services and Fintech
- Banking, Finance, and Investments
- Technology, Startups, and Digital Business
Request a consultation
Find out which licence you actually need
Describe the product and how money moves through it. We will tell you whether it is licensable in Kenya, which regulator it falls to, and what the realistic route to authorisation looks like.
Confidentiality guaranteed. All communications with Gracen Law are protected by legal professional privilege. Your information is never shared with third parties.
Send us a message
We respond within 2 business hours. Fields marked * are required.
Reviewed by the Gracen Law fintech & financial services team · Last reviewed 26 August 2026