Payment service provider licensing
Authorisation under the National Payment System Act, 2011 and its 2014 Regulations, across the Central Bank of Kenya's categories — electronic retail payment service provider, payment instrument issuer, e-money issuer and small e-money issuer. Choosing the right category, and confirming whether a business needs its own licence at all rather than operating through an already-licensed partner, is usually the first substantive question.
Digital and non-deposit-taking lending
Digital lenders have operated under the CBK (Digital Credit Providers) Regulations, 2022, covering pricing disclosure, debt collection conduct, data protection and AML. The Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026 were gazetted on 29 September 2026 (Legal Notice 191 of 2026), widening CBK oversight to non-deposit-taking credit providers more generally — including offline lenders — with a licensing threshold tied to capital, borrowings or loan book size, and an application window running from the regulations' publication date.
Because this framework changed very recently, we confirm a lender's position against the regulations as currently in force before advising on next steps, rather than against their draft-stage description.
Virtual asset service provider (VASP) licensing
The Virtual Asset Service Providers Act, 2025 commenced on 4 November 2025, with the Virtual Asset Service Providers Regulations, 2026 gazetted that July. Supervision splits by activity: the CBK takes wallet custody, payment processing and stablecoin issuance, while the CMA takes exchanges, brokerage, investment advice, asset management and token offerings — a business spanning both may need two licences. Section 47 of the Act gives businesses already operating until 4 November 2026 to come into compliance, after which operating without a licence is an offence.
AML, CFT and KYC programmes
Anti-money laundering frameworks under the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA): risk assessment, customer due diligence, transaction monitoring, reporting to the Financial Reporting Centre and staff training. For a licence applicant this is assessed as part of the application rather than afterwards, and a weak or generic AML programme is one of the most common reasons an application is held up.
Related Gracen Law services
Related Gracen Law services
More in this section
Regulatory and Public Affairs
Consultation
Get Expert Legal Advice on Fintech and Financial Services Licensing Today
Submit the form and a senior advocate will respond within two business hours, in confidence.
Communications are protected by legal professional privilege and never shared with third parties.
Questions
Frequently asked questions
Which licence does a payments business in Kenya need?
It depends on what the business actually does with customer funds. The National Payment System Regulations, 2014 set out distinct categories, and the obligations differ significantly between them. Businesses sometimes discover their model does not need its own licence at all because the regulated activity is carried out by a partner bank or an already-licensed provider — that question is worth resolving before you build.
Do I need a licence to operate a virtual asset business in Kenya?
Since the Virtual Asset Service Providers Act, 2025 commenced, virtual asset activities require authorisation from the CBK or the CMA depending on the activity, and a business doing both may need two licences. Section 47 of the Act gives businesses already operating until 4 November 2026 to come into compliance.
What happens if a regulator raises a compliance concern?
It usually begins with an information request rather than enforcement, and how that is answered materially affects what follows. We advise on the response and, where needed, on the remediation plan that accompanies it.