Even so, the rapid expansion of the digital banking sector was accompanied by significant consumer protection concerns, ranging from predatory lending practices to unethical loan recovery methods in the form of random unsolicited messages, threats and embarrassment as digital lenders went to the extent of accessing a borrower’s phone data and compelling a family member or friend who may have been listed as guarantors to repay the defaulted loans. This prompted the Central Bank of Kenya (CBK) to enact the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022, (Regulations) following the amendment of the Central Bank of Kenya Act (CBK Act) in 2021 by the introduction of section 33S, which outlined licensing requirements for digital credit providers (DCP).

The latest CBK report issued in October 2024 states that while more than 730 DCPs have applied for licensing, only 85 have received their licences. The rest are still in the vetting process pending submission of requisite documentation.

However, in 2024, the CBK Act was amended by deleting references to “digital credit business” in sections 33S and sections 57 of the CBK Act and replacing with “non-deposit taking credit business”. It is interesting to notice that section 59 of the CBK Act still requires persons that were carrying out digital credit business prior to the coming into force of the CBK Act and are not regulated by any other law to apply for a licence from the CBK.

There seems to be a lacuna in the law relating to the licensing of DCPs given the 2024 amendments to the CBK Act. It is therefore debatable whether the DCPs that are yet to obtain their DCP licences can operate without a licence from the CBK.

In the Small Claims Court

In SCCCOMM/E9994/2025, M-collect Limited vs. Mbwana Kalua the Small Claims Court noted that six unlicensed DCPs had developed a concerning litigious pattern where they would file numerous claims and thereafter abandon them. Upon inquiry, the court noted that one of the unlicensed DCPs, Aventus Technology Limited, had stated that it was in the “pipelines of compliance”. Consequently, the court dismissed the 139 claims that had been filed by the unlicensed DCPs by ruling that entertaining the claims by such persons without proper legal standing (by lacking the requisite licensing) would be tantamount to sanctioning illegality.

It bears noting that the six unlicensed DCPs whose claims were dismissed are compliant with the Data Protection Act, 2019 and have obtained the requisite certificates as data processors/data handlers that can be gleaned from the ODPC website, which is one of the mandatory requirements prior to being issued with a licence. Given the amendment of sections 33S and 57 of the CBK Act, it would be interesting to see the course of action to be taken by the partially compliant DCPs considering the issue of licensing under sections 33S and 57 alluded to above.

It also remains to be seen whether there will be further amendments to the CBK Act and the Regulations noting the fact that the amendments introduced in 2024 deleted references to licensing of digital credit businesses whilst some DCPs have applied for licences.