Kenya’s digital lending sector has grown rapidly since the mid-2010s, fueled by mobile penetration and smartphone adoption. Loan apps such as Tala, Branch, and M-Shwari have become household names, offering instant microloans through mobile interfaces or USSD codes. By June 2025, licensed digital credit providers (DCPs) had disbursed 5.5 million loans worth KSh 76.8 billion ($594 million). These loans fund a wide range of needs, from paying school fees to supporting small businesses.
This rise has also presented challenges. Borrowers have faced predatory interest rates, sometimes exceeding 100% annually, aggressive recovery practices including harassment, and data privacy violations. These concerns prompted regulators to strengthen loan app regulation in Kenya, with the Central Bank of Kenya (CBK) as the lead authority, supported by other regulatory bodies.
CBK’s Central Role in Loan App Regulation
The legal foundation for CBK’s oversight came through the Central Bank of Kenya (Amendment) Act, 2021. Effective December 23, 2021, this Act gave CBK powers to regulate and license non-deposit-taking digital lenders. Before this, only banks and mobile network operators like Safaricom’s M-Pesa were supervised, leaving loan apps outside formal oversight.
To implement the law, CBK introduced the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022. These regulations, gazetted on March 18, 2022, required all digital lenders to seek approval within six months. Those failing to comply risked penalties of up to KSh 5 million or three years in prison.
Licensing for digital credit providers involves strict requirements. Applicants must present business plans, demonstrate minimum capital (KSh 50 million for most providers), and comply with anti-money laundering frameworks. They must also show compliance with the Data Protection Act, 2019, and submit proof of integrity through tax certificates and clean Credit Reference Bureau (CRB) records for their directors. The CBK works with the Office of the Data Protection Commissioner (ODPC) during the vetting process to ensure borrowers’ rights are protected.
As of September 2025, CBK has licensed 153 providers, including Tala (Inventure Mobile), Anjoy Credit, and Jumo Kenya. Approvals have accelerated in recent months, with 27 granted on September 2, 2025, and 41 more in July, up from just 22 in early 2023. The regulator publishes a monthly directory of approved firms and advises Kenyans to confirm legitimacy or report suspicious lenders through dcps@centralbank.go.ke.
Unlicensed loan apps remain a key concern. CBK has directed their closure, while Google has reinforced compliance by requiring CBK licensing for all loan apps on the Play Store. So far, Google has removed nearly 500 Kenya-focused loan apps, including MoKash and Okash, after the CBK rules took effect. These removals have targeted apps accused of predatory interest rates, misuse of personal data, and failure to meet licensing conditions.
Borrower Protection and Interest Rate Controls
Loan app regulation under CBK also covers fair practices. Digital lenders must disclose full loan terms upfront, including annual interest rates, and are prohibited from harassment during debt collection. They cannot threaten borrowers or share default lists without consent.
Predatory interest rates remain a risk, but protections such as the in duplum rule, limiting interest accrual to the size of the principal, apply to digital loans. During COVID-19, CBK eased borrower burdens through Gazette Notice No. 55 of 2020, which delisted small defaults under KSh 1,000 from CRBs and barred non-bank DCPs from submitting data to CRBs.
In 2025, CBK introduced KESONIA, a new benchmark interest rate tied to interbank lending, designed to standardize loan pricing and reduce opaque charges. It also drafted the Non-Deposit Taking Credit Providers Regulations, 2025, which propose tiered licensing based on loan book size (with a KSh 20 million threshold) and higher compliance fees. These reforms aim to increase transparency and reduce the risk of high-interest traps. Violations of regulations can lead to fines, inspections, or even license revocation under Regulation 37.
Beyond CBK: The Multi-Regulator Ecosystem
Loan app regulation in Kenya extends beyond the Central Bank, with other authorities addressing competition, consumer rights, and data protection.
- Competition Authority of Kenya (CAK)
Oversees fair play in the market under the Competition Act, 2010. It investigates practices such as predatory pricing, anti-competitive mergers, and unfair fees. In 2025, CAK opened investigations after complaints about loan charges reaching up to 40% per month and repayment terms involving foreign currency. Complaints surged by 28% to 858 cases that year. The agency is pushing for legal amendments to cover digital markets more directly.
- Office of the Data Protection Commissioner (ODPC)
Enforces the Data Protection Act, 2019. DCPs must register as data controllers, obtain consent for data sharing, and protect personal information. ODPC’s 2024 guidance note requires lenders to publish clear privacy policies. Apps found guilty of unauthorized disclosures during collections face heavy penalties, including fines of up to 5% of global turnover.
- Capital Markets Authority (CMA)
Has a more limited role, regulating DCPs that securitize loan portfolios into financial instruments such as bonds. It operates under the Capital Markets Act, Cap 485A, to prevent fraud. CMA also promotes financial literacy, indirectly helping borrowers make more informed choices.
Loan app regulation has reduced the number of rogue players. Out of 381 applicants in 2023, only 153 were licensed by 2025. Licensed providers now serve around 8 million monthly users, with disbursements averaging KSh 15 billion.
Jefferson Wachira is a writer at Africa Digest News, specializing in banking and finance trends, and their impact on African economies.