How CBK's new rules are set to reshape Kenya's digital lending market
Opinion
By
James Mungai
| Oct 07, 2026
Kenya's era of light-touch digital lending ended on 29th September 2026. That day, the Central Bank of Kenya gazetted the Non-Deposit-Taking Credit Providers Regulations, 2026 (Legal Notice 191).
The label "digital credit provider" (DCP) is on its way out. Every lender that extends credit without taking deposits such as app lenders, buy now pay later platforms, hire purchase operators, pay as you go financiers and peer-to-peer platforms, all now answer to the CBK. Existing players have six months to apply for a licence or registration under the new regime.
By September, the CBK had licensed 281 digital lenders. Their loan book grew from Sh28.9 billion in 2023 to Sh133.5 billion by February 2026, spread across about 7.5 million borrowers. That growth was built on speed: Approval in minutes, small loans and collections that too often relied on pressure rather than process. The new rules are the regulator's answer to the second half of that story.
Staying in the game now costs real money. The application fee rises from Sh5,000 to Sh100,000. The annual fee for a licensed lender jumped from Sh20,000 to Sh500,000, while registered lenders will now pay Sh250,000.
READ MORE
Banks tighten lending to stem resurgence in bad loans
Kenya's first Ebola case raises concerns over trade barriers in EAC
African capital markets leaders seek to unlock Sh516tr for development
The city startup building trade from broken glass
Unilever invests Sh70m in solar to cut energy costs
Safaricom unveils Shari'ah compliant Ziidi MMF
Ruto unveils Sh390bn Geely electric mobility plan
Kenya seeks private investors to fund 61 per cent of Sh598bn irrigation plan
Kenyans can now buy into Dangote's Sh207 billion IPO after CMA nod
Anyone who misses the 31st December payment deadline will face a Sh1 million penalty. Any lender with more than Sh20 million in capital, borrowings or loan book must be licensed rather than registered.
A new product or a change to an existing one, including an interest rate change, will need prior CBK approval and 30 days' notice to customers. Automated credit decisions must be explainable, disclosed to borrowers and subject to human oversight.
For a well-capitalised lender, this will be the cost of doing business. For the long tail of thinly funded app lenders, the numbers might stop working.
My reading is that the DCP space will consolidate over the next 12 to 18 months. Some will merge, some will sell, some will simply stop lending. But loan books do not disappear when a lender exits. They get sold, written off or handed over for recovery. I expect a steady flow of small-ticket non-performing portfolios into the market, many of them poorly documented and inflated by rollover fees.
That inflation is about to meet a hard ceiling. The rules cap what a lender can recover on a non-performing loan. In the draft, that ceiling was the outstanding principal, interest equal to it, and reasonable recovery costs. In effect, the duplum rule extended beyond banks.
A balance that has tripled through penalties is now a paper number, not a recoverable one. Anyone buying or collecting these books must price them on what the law allows them to recover, not on what the system says is owed. Scraping phone contacts, shaming borrowers to friends and harassing them remain banned.
This is where the collection and recovery industry changes shape. Lenders will now be judged by how their books are recovered, so they will choose collectors on compliance as much as on recovery rates.
The firms that win mandates will be those that can produce a signed loan agreement, a clean statement of account, a record of consent under the Data Protection Act, a proper CRB notice and a credible legal escalation path. Collectors without an audit trail will lose business. Recovery stops being a volume game and becomes a discipline of evidence, process and judgement.
I see this reset as healthy. Credit only works when both sides trust the contract, and Kenya's digital credit market spent too long eroding that trust. Borrowers gain protection, serious lenders gain a cleaner market, and recovery firms built on professionalism gain a larger, better quality pipeline. Operators who relied on fear will find that six months passes very quickly.
CPA James Kamau is a Certified Public Accountant and Founder -Marathon Debt Recovery Ltd