The Central Bank of Kenya (Digital Credit Providers) Regulations

Section 1. Citation Section These Regulations may be cited as the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022.

Section 2. Application Section an institution licensed under the Banking Act (Cap. 488);

Section 3. Interpretation Section In these Regulations, unless the context otherwise requires— "Act" means the Central Bank of Kenya Act; "Bank" means the Central Bank of Kenya; "charges" includes all the payments that a customer makes, is required to make, or agrees to make to a digital credit provider in consideration of the loan by the digital credit provider to the customer, and all interest, fees, expenses and costs associated with the provision of the loan; "credit information" means any positive or negative information relating to an individual’s or entity’s credit worthiness, credit standing, credit capacity, or history or profile with regard to credit, assets, and any financial obligations; "customer" means a person who obtains digital credit from a digital credit provider; "deposit" means a sum of money received or paid on terms under which it shall be repaid, with or without interest or a premium, and either on demand, or at a time or in circumstances agreed by or on behalf of the person making the payment and the person receiving it; "non-performing loan" means a loan in which the principal or interest is due and unpaid after the due date as per the contract between the...

Section 4. Licensing Section 4(1) A person shall not establish or carry out digital credit business in Kenya or otherwise hold himself out as carrying out digital credit business in Kenya unless that person is licensed by the Bank in accordance with these Regulations, or is a person whose digital credit business is regulated under any other written law. Section 4(2) A person who wishes to carry out digital credit business in Kenya shall apply to the Bank for a licence in Form CBK DCP 1 set out in the First Schedule. Section 4(3)(a) certified copy of the certificate of incorporation of the applicant; Section 4(3)(b) a certified copy of the Memorandum and Articles of Association of the applicant; Section 4(3)(c) notification of the applicant’s registered address; Section 4(3)(d) a certified copy of the Memorandum and Articles of Association of any corporate body that has a significant shareholding in the applicant; Section 4(3)(e) a certified copy of the constitutive documents of an unincorporated body that has a significant shareholding in the applicant; Section 4(3)(f) a description of the information and communication technology system to be used in the applicant’s operations and...

Section 5. Issuance of a licence Section 5(1) The Bank shall, if satisfied that the applicant meets the requirements of these Regulations, grant a licence to the applicant, within sixty days of submission of a complete application. Section 5(2)(a) the history of the applicant; Section 5(2)(b) the professional and moral suitability of the persons proposed to manage or control the digital credit provider; Section 5(2)(c) the sources and evidence of funds to be invested by or in the digital credit provider; and Section 5(2)(d) the public interest. Section 5(3) The Bank may grant a licence to an applicant who meets the requirements of these Regulations subject to such conditions as the Bank may consider necessary which may be varied from time to time. Section 5(4) The Bank shall publish the name of every licensed digital credit provider in the Gazette and in the Bank’s website within thirty days of grant of licence. Section 5(5) A licence granted under these Regulations shall remain valid unless earlier suspended or revoked by the Bank in accordance with these Regulations. Section 5(6) A digital credit provider shall on or before the thirty-first day of December every year pay annual f...

Section 6. Licence not transferable Section The licence granted under regulation 5 shall not be transferred, assigned or encumbered in any way without prior written approval of the Bank.

Section 7. Fit and proper obligations Section 7(1) A digital credit provider shall notify the Bank of any intended changes in its significant shareholding, board or management structure, or the appointment of a new director, chief executive officer or a senior officer at least thirty days before the effective date of such changes or appointments. Section 7(2) No person shall be a significant shareholder, director, chief executive officer or a senior officer of a digital credit provider unless the Bank has certified the person as fit and proper in accordance with the criteria set out in the Third Schedule. Section 7(3) The Bank may, from time to time, where it considers it necessary, carry out an assessment of the professional and moral suitability of director, a chief executive officer, significant shareholder or a senior officer of a digital credit provider. Section 7(4) The Bank may direct a significant shareholder who is considered by the Bank as not fulfilling the fit and proper criteria to dispose of all of their shares in a digital credit provider within such period as the Bank may specify. Section 7(5) The Bank may disqualify any person from holding the position of director,...

Section 8. Activities of a digital credit provider Section 8(1)(a) provision of credit; and Section 8(1)(b) any other activity as may be approved by the Bank from time to time. Section 8(2) A digital credit provider shall not invite or collect deposits in any form, including the taking of cash collateral as security for loans, in the course of carrying out digital credit business. Section 8(3) A digital credit provider who contravenes the provisions of paragraph (2) shall be liable to assessment of penalties and other administrative sanctions as provided for in these Regulations, including revocation of the digital credit provider’s licence.

Section 9. Suspension or revocation of licence Section 9(1)(a) does not meet or has contravened any of the licensing conditions; Section 9(1)(b) fails to pay annual fees or a monetary penalty that is imposed by the Bank; Section 9(1)(c) is found to have given false information during the licence application; Section 9(1)(d) ceases to carry on the business of a digital credit provider; Section 9(1)(e) goes into liquidation or an order is issued for its winding up; Section 9(1)(f) violates anti-money laundering laws or combating the financing of terrorism laws; Section 9(1)(g) has contravened any of the provisions of the Act or any regulations made thereunder relating to digital lending; or Section 9(1)(h) otherwise conducts its business in a manner detrimental to the interests of its customers or members of the public. Section 9(2) The Bank shall before suspending or revoking a licence inform the licensee in writing of the intended suspension or revocation and give the licensee an opportunity to be heard. Section 9(3) The Bank shall specify the reasons for and the period of suspension of a digital credit provider’s licence, and shall at the expiry of that period, lift the suspension...

Section 10. Amalgamations and transfer of assets and liabilities Section 10(1) A digital credit provider shall not enter into an amalgamation or an arrangement to transfer all or any part of its assets and liabilities to another entity without the prior written approval of the Bank. Section 10(2) Notwithstanding paragraph (1), a digital credit provider shall not require the prior approval of the Bank to undertake transactions in the ordinary course of business, including asset disposals in the ordinary course of business. Section 10(3) A digital credit provider shall notify the Bank at least thirty days before entering into any agreement or arrangement with a third party for purposes of investing in the digital credit provider or financing the activities of the digital credit provider. Section 10(4) The Bank may direct a digital credit provider to submit such additional information and documents as it may consider necessary for purposes of considering any transaction, agreement or arrangement under this Regulation.

Section 11. Corporate governance Section A digital credit provider shall practice sound corporate governance principles based on ethics and integrity, good reputation and legitimacy, sound risk management and compliance with the law.

Section 12. Place of business Section 12(1) A digital credit provider shall have at least one registered physical office in accordance with the requirements of the Companies Act, 2015 ( No. 17 of 2015 ). Section 12(2) A digital credit provider shall not open, relocate or close a branch or place of business without prior written notification to the Bank, at least thirty days before the opening, relocation or closure. Section 12(3) A digital credit provider shall prominently display a copy of its licence in all its places of business.

Section 13. Confidentiality Section 13(1) A digital credit provider shall put in place appropriate policies, procedures and systems to ensure the confidentiality of customer information and transactions. Section 13(2) A digital credit provider shall not share customer information with any other person except with the customer’s consent, or as may be required or permitted under any written law. Section 13(3) The directors, officers, employees and agents of a digital credit provider shall protect the confidentiality of customer information and transactions. Section 13(4) A director, officer, employee or agent of a digital credit provider shall not during, or upon and after termination of engagement or employment with the digital credit provider, except in the proper course of his duty and with the digital credit provider’s written consent, divulge or make use of any secrets, copyright material, or any correspondence, accounts of the digital credit provider or its customers.

Section 14. Exchange of credit information Section 14(1) Notwithstanding any other provision in these Regulations, a digital credit provider shall disclose both positive and negative credit information of its customers to licensed credit reference bureaus, where such information is reasonably required for the discharge of the functions of the digital credit provider or the licensed credit reference bureaus. Section 14(2) A digital credit provider may obtain credit information of its customers from a licensed credit reference bureau, where such information is reasonably required for the discharge of the functions of the digital credit provider or the licensed credit reference bureau. Section 14(3) A digital credit provider shall not submit negative credit information of a customer or any other person to a credit reference bureau where the outstanding amount relating to the credit information does not exceed one thousand shillings. Section 14(4) A digital credit provider submitting credit information to a bureau shall ensure that such information is timely, complete and accurate. Section 14(5) A digital credit provider who intends to furnish negative information to a bureau with resp...

Section 15. Restrictions on use of credit information Section 15(1) A digital credit provider shall not use credit information obtained from a bureau for any purpose other than for reaching decisions on transactions concerning a customer, and on matters concerning an employee or a potential employee of the digital credit provider or for any other purpose as may be authorized under these Regulations or any other written law. Section 15(2) A digital credit provider shall not release information obtained from a credit reference bureau to any third party except as may be required under these Regulations or any other relevant written law, or to a digital credit provider's appointed agent for the purpose of assisting the digital credit provider in the recovery of any of the digital credit provider’s debts. Section 15(3) A digital credit provider shall take measures to safeguard the security of information provided to it by a credit reference bureau, or by it to a credit reference bureau.

Section 33. Reporting requirements, on-site and off-site monitoring Section 33(1) A digital credit provider shall be subject to the Bank’s on-site and off-site inspection, audit and monitoring and shall make such periodic reports and returns as may be specified by the Bank. Section 33(2) The Bank may require a digital credit provider to furnish it, at such time and in such manner as it may direct, with such information as the Bank may reasonably require for the proper discharge of its functions under these Regulations. Section 33(3) A digital credit provider shall make its premises, systems, books and records readily available to the Bank, or its officers or any person appointed by the Bank for inspection, audit and other supervisory purposes. Section 33(4) A digital credit provider who fails to comply with this Regulation shall be liable to assessment of penalties and other administrative sanctions as provided for in these Regulations.

Section 34. Disclosure of information Section The Bank may disclose any information received in the course of the performance of its duties or responsibilities under the Act or these Regulations to any financial regulatory authority, fiscal or tax agency or fraud investigations agency within or outside Kenya, where such information is reasonably required for the proper discharge of the functions of the Bank or the requesting financial regulatory authority, fiscal or tax agency or fraud investigations agency: Provided that the sharing of information with institutions and entities outside Kenya shall only apply where there is a reciprocal arrangement.

Section 35. Powers of the Bank to advise and direct Section 35(1)(a) the business of a digital credit provider is being conducted in a manner contrary to the requirements of the Act, these Regulations or guidelines issued by the Bank or in any manner detrimental to or not in the best interests of its customers or members of the public; or Section 35(1)(b) give advice and make recommendations to the digital credit provider with regard to the conduct of its business generally; Section 35(1)(b)(i) give advice and make recommendations to the digital credit provider with regard to the conduct of its business generally; Section 35(1)(b)(ii) issue directions regarding measures to be taken to improve the management or business methods of the digital credit provider or to secure or improve compliance with the requirements of the Act, the Regulations or guidelines issued or any other written law or regulations; or Section 35(1)(b)(iii) in any case to which paragraph (b) applies, issue directions to the digital credit provider, officer or other person to cease and desist from such practice. Section 35(2) The Bank may, before issuing any directions under paragraph (1), serve upon the digital c...

Section 16. Provision of credit Section 16(1) A digital credit provider may extend loans to its customers subject to its credit policy and any other requirements issued by the Bank, and clearly state the terms and conditions. Section 16(2) A digital credit provider may in its credit policy set parameters for determining borrower credit limits.

Section 17. Product approval Section 17(1) A digital credit provider shall not introduce a new digital credit product to the market or vary the features of an existing product without the Bank’s prior written approval. Section 17(2) A digital credit provider shall notify its customers of any variations in product features at least thirty days before the variations take effect.

Section 18. Credit appraisal Section A digital credit provider shall not advance credit to a customer before it has taken reasonable steps to assess the customer’s ability to repay the credit facility.

Section 19. Limit on interest recoverable from non-performing loans Section 19(1) A digital credit provider shall be limited in what it may recover from a customer with respect to a non-performing loan to the maximum amount under paragraph (2). Section 19(2)(a) the principal owing when the loan becomes non-performing; Section 19(2)(b) interest in accordance with the contract between the customer and the digital credit provider, not exceeding the principal owing when the loan becomes non-performing; and Section 19(2)(c) reasonable expenses incurred in the recovery of any amounts owed by the customer. Section 19(3) If a loan becomes non-performing and then the customer resumes payments on the loan and then the loan becomes non-peforming again, the limitation under paragraph 2(a) and (b) shall be determined with respect to the time the loan last became non-peforming. Section 19(4) This Regulation shall not apply to limit any interest under a court order accruing after the order is made.

Section 20. Credit collection Section use of threat, violence or other means to harm the person, or his reputation or property if they do not settle their loans;

Section 21. Transaction receipts Section 21(1) A digital credit provider shall generate and issue a receipt or any other acknowledgement of transactions carried out by or with a customer, through electronic means or any other acceptable medium. Section 21(2) A digital credit provider shall upon request by the customer generate and issue the customer with a comprehensive statement of transactions carried out by or with the customer.

Section 22. Customer complaints resolution Section 22(1) A digital credit provider shall establish a complaints redress mechanism, including a dedicated channel for communicating customer complaints, and ensure proper communication of this mechanism to its customers. Section 22(2) A customer complaint shall be resolved promptly, and where immediate resolution is not possible, within thirty days of a customer reporting a complaint to a digital credit provider. Section 22(3) A digital credit provider shall keep a record of all complaints lodged by customers and the outcome of their resolution. Section 22(4) A digital credit provider who fails to comply with this Regulation shall be liable to assessment of penalties and other administrative sanctions as provided for in these Regulations.

Section 23. Business continuity Section A digital credit provider shall put in place systems and processes for purposes of minimizing disruptions and ensuring business continuity.

Section 24. Information systems Section A digital credit provider shall use systems that are secure and reliable, and which ensure information confidentiality, integrity and availability.

Section 25. Customer information Section prepare and maintain key information document that informs the customer of the fundamental benefits, risks and terms of the product or service, in a summarized form;

Section 26. Access and collection of customer information Section 26(1) A digital credit provider shall only access and collect such customer information as is reasonably required for a customer's credit appraisal, approval, disbursement and collection. Section 26(2) A digital credit provider shall provide the customer with an opportunity, feature or function for opting out of marketing messages by the digital credit provider.

Section 27. Terms and conditions Section 27(1) A digital credit provider shall provide to the customer the terms and conditions constituting the loan agreement between a digital credit provider and a customer before granting the loan. Section 27(2)(a) the loan amount; Section 27(2)(b) the loan charges and the circumstances under which they may be imposed; Section 27(2)(c) interest rate to be charged and whether on reducing balance or not; Section 27(2)(d) all other charges applicable to the loan; Section 27(2)(e) the date on which the amount of credit and all interest, charges, fees or any other liabilities are due and payable, and how they may be calculated; Section 27(2)(f) total cost of credit which shall include the principal amount, interest, fees, charges and any other liabilities; Section 27(2)(g) the annual percentage rate of interest; and Section 27(2)(h) customer complaint handling channels and procedures. Section 27(3) The terms and conditions shall be presented to the customer in a clear, simple and easily accessible format and language. Section 27(4) A digital credit provider shall upon request provide the customer with a copy of the terms and conditions constituting t...

Section 28. False advertisements Section 28(1) A digital credit provider shall ensure that any advertisement that it publishes or authorizes to be published does not include any false, misleading or deceptive representation, or is otherwise misleading or deceptive. Section 28(2)(a) a representation that the credit facility has benefits or qualities that it does not in fact have; Section 28(2)(b) a representation that the digital credit provider has an approval, status, affiliation or connection that it does not in fact have; Section 28(2)(c) an inaccurate or incomplete representation as to the interest rate, costs or charges payable under a digital credit facility.

Section 29. Variation of credit terms Section 29(1) A digital credit provider shall not change its pricing model or parameters without the prior written approval of the Bank. Section 29(2) A digital credit provider shall not increase charges or credit limits or have a provision in the agreement with the customer that varies the credit terms under regulation 27(1)(a) to (e) unless the digital credit provider has given at least thirty-days prior notice of the intended changes to the customer and the customer has accepted the changes. Section 29(3) The notification under paragraph (2) shall clearly disclose to the customer the changes in the credit terms and shall incorporate the disclosure requirements under regulation 27.

Section 30. Sources of funds Section A digital credit provider shall provide to the Bank the evidence and sources of funds invested or proposed to be invested in the digital credit business and demonstrate that the funds are not proceeds of crime.

Section 31. Customer identity Section A digital credit provider shall take reasonable measures to satisfy itself as to the identity of its customers while performing transactions with them.

Section 32. Compliance with laws on anti-money laundering and combating the financing of terrorism Section 32(1) A digital credit provider shall comply with the Proceeds of Crime and Anti-Money Laundering Act, 2009, and the Prevention Terrorism Act, 2012 and the relevant Regulations and Guidelines issued thereunder; Section 32(2) A digital credit provider who fails to comply with the Proceeds of Crime and Anti-Money Laundering Act, 2009, and the Prevention of Terrorism Act, 2012, and the relevant Regulations and Guidelines issued thereunder shall be liable to assessment of penalties and other sanctions as provided for under these Regulations.

Section 36. Duty to comply Section 36(1) Every digital credit provider or any other relevant person shall comply with the provisions of the Act, these Regulations, or any other Regulation or Guideline issued under the Act relating to digital credit business. Section 36(2) In addition to the requirements of the Act, these Regulations and any other regulations made under the Act, every digital credit provider or any other relevant person shall comply with every directive or order given by the Bank, and every condition imposed by the Bank. Section 36(3) Non-compliance with the requirements of paragraphs (1) and (2) shall constitute non-compliance with directions of the Bank and may attract enforcement action under these Regulations.

Section 37. Enforcement and administrative sanctions Section 37(1)(a) monetary penalty on a digital credit provider in such amounts not exceeding five hundred thousand shillings; Section 37(1)(b) additional penalties not exceeding ten thousand shillings in each case for each day or part thereof during which the violation or non-compliance continues; Section 37(1)(c) suspension from office of the non-compliant digital credit provider’s director or officer; Section 37(1)(d) disqualify a significant shareholder, director or officer from holding any position or office in any licensed or financial institution in Kenya; Section 37(1)(e) undertake more frequent inspections of that digital credit provider; Section 37(1)(f) order the digital credit provider to submit to the Bank, within forty-five days, a plan to resolve all deficiencies to the satisfaction of the Bank; Section 37(1)(g) suspension or revocation of the licence; and Section 37(1)(h) any other action as the Bank may consider appropriate.

Section 38. When administrative action may be taken Section violation of or non-compliance with any of the provisions of the Act relating to digital credit business;

Section 39. Factors to consider in determining an administrative sanction Section 39(1)(a) whether the person to be sanctioned or penalized is a natural person or corporate body; Section 39(1)(b) the nature of the legal or regulatory requirement, direction, order or condition which has been violated or not complied with; Section 39(1)(c) the nature and severity of the violation; Section 39(1)(d) the impact of the violation on the digital credit provider, its customer or other person; Section 39(1)(e) the benefits that could be or may have been derived from the violation; Section 39(1)(f) the amount of financial loss or other losses suffered or likely to be suffered by the digital credit provider, customer or other person; Section 39(1)(g) the circumstances under which the violation occurred; Section 39(1)(h) the financial condition of the digital credit provider or any other person at fault including in terms of size, assets, capital, loan portfolio, annual turnover and any other relevant financial condition; Section 39(1)(i) the frequency of violation of the same law, other laws, direction, order or condition; Section 39(1)(j) general level of compliance with the law by the digita...

Section 40. Determination of sanctions on case-by-case basis Section The determination of administrative sanctions shall be carried out on a case-by-case basis and different sanctions may be imposed for different violations or against different digital credit providers or any other person: Provided that any difference in the treatment of digital credit providers or any other person shall be justified by the Bank.

Section 41. Notice to Show Cause Section 41(1) If the Bank determines that a digital credit provider or any other person has violated any provision of the Act, these Regulations, or any other regulations or guidelines issued under the Act, or has failed to comply with any direction given, or condition imposed by the Bank, the Bank shall notify the digital credit provider or the person of the violation and invite the digital credit provider or the person to show cause why an administrative sanction should not be assessed and imposed. Section 41(2)(a) describe in general terms the facts or circumstances that constitute the violation or non-compliance; Section 41(2)(b) state the legal or regulatory requirement which was violated or the direction, order or condition which was not complied with; Section 41(2)(c) describe the person or entity which may have been involved in the violation if such information is within the knowledge of the Bank; Section 41(2)(d) notify the digital credit provider or any other person of the intention of the Bank to assess and impose an administrative sanction; Section 41(2)(e) specify the proposed administrative sanction; Section 41(2)(f) state the period w...

Section 42. Consideration of representations received Section whether an administrative sanction should be imposed against a digital credit provider or any other person;

Section 43. Representation not made or is made out of time Section 43(1) Where the Bank has not received any representation from the digital credit provider or any other person within the specified period or where the representation is received after the specified period, the Bank may proceed to determine and impose the appropriate administrative sanction. Section 43(2) The Bank may upon request by a digital credit provider or any other relevant person extend the time within which the notice to show cause may be responded to.

Section 44. Notification on determination of administrative sanction Section the violations for which the determination has been made;

Section 45. Sanction not to affect other forms of sanctions Section The imposition of one administrative sanction against a digital credit provider or any other relevant person shall not bar the Bank from imposing any other or additional sanctions as is provided for under the Act, these Regulations or any other written law.

Section 46. Rectification of the violation Section to desist from any act or omission in order to end any continued violation of the Act, these Regulations, or any other regulations or guidelines issued under the Act, or any direction, order or condition imposed by the Bank; or

Section 47. Period within which rectification is to be made Section Where the Bank requires a digital credit provider or any other relevant person to take a specific action to rectify or remedy a violation, the Bank shall specify the period within which the remedial action should be taken: Provided that a digital credit provider or any other relevant person may on their own motion, rectify or remedy any violation.

Section 48. Review Section 48(1) A digital credit provider or any other relevant person aggrieved by the decision of the Bank under these Regulations, may within fourteen days from the date of notification of the Bank’s decision request the Bank to review the decision. Section 48(2) The request for review under this Regulation shall not suspend the effective date of the Bank’s decision, including the commencement of an administrative sanction or requirement for a digital credit provider or any other relevant person to pay a monetary penalty unless the digital credit provider or any other relevant person requests the Bank for such suspension pending the determination of the request for review and the Bank has suspended the commencement of its decision. Section 48(3) Any request for the suspension of the commencement of an administrative sanction shall be made before the effective date of the administrative sanction.

Section 49. Grounds for review Section the violation did not take place;

Section 50. Request for additional information Section The Bank may request the applicant to submit such additional information as the Bank may require to enable it determine the request for review.