CBK targets rogue lenders with new draft regulations, seeks public feedback

Central Bank of Kenya Governor Kamau Thugge. CBK) has published draft regulations for non-deposit-taking credit providers in a renewed effort to strengthen consumer protection, (Photo: X/CBK)

By Rachael Mutabasi
Thursday, August 7, 2025

The proposed rules address key areas such as transparency in loan agreements, responsible use of customer data, effective complaint resolution, and fair marketing and advertising practices.

The Central Bank of Kenya (CBK) has published draft regulations for non-deposit-taking credit providers (NDTCPs) in a renewed effort to strengthen consumer protection, promote ethical lending, and close regulatory gaps in the country’s digital credit sector.

The proposed rules address key areas such as transparency in loan agreements, responsible use of customer data, effective complaint resolution, and fair marketing and advertising practices.

More To Read

In a statement, CBK invited members of the public to submit written feedback on the Draft Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2025 by September 6, 2025.

The draft regulations are issued under the Central Bank of Kenya (Amendment) Act, 2021, which brought Digital Credit Providers (DCPs) under CBK’s oversight. The new rules extend that regulatory scope to include other non-deposit-taking lenders.

Broader legal reforms

CBK noted that since the introduction of the Digital Credit Providers Regulations, 2022, notable progress had been made, including the licensing of 126 DCPs.

However, ongoing issues, such as unethical debt collection, excessive loan charges, and the misuse of personal data, have highlighted the need for broader legal reforms.

“While significant progress has been made in regulating Digital Credit Providers, including the licensing of 126 DCPs so far, persistent challenges in the legal and regulatory framework have necessitated further reforms,” CBK said.

“In that regard, the CBK Act was further amended by the Business Laws (Amendment) Act, 2024, to, inter alia, widen the scope of operations for Non-Deposit Taking Credit Providers. The term ‘digital’ was also replaced with ‘non-deposit taking’ to address confusion among industry players and the public regarding the scope of the DCP framework.”

Under the new draft, NDTCPs will be required to submit both positive and negative credit information to licensed credit reference bureaus, except where the unpaid amount is less than Sh1,000. Customers must be given at least 30 days’ notice before negative listings, or seven days in the case of short-term loans.

Clear loan agreements

To enhance consumer protection, lenders must provide loan agreements that clearly outline the total cost of credit, applicable interest rates, repayment schedules, and the borrower’s right to repay early without penalties. Borrowers must also receive timely receipts, account statements, and access to up-to-date financial records.

In addition, NDTCPs must disclose the total cost of credit—specifying whether the rates are monthly or annual—in all advertising materials. The rules also prohibit misleading promotions, aggressive debt collection practices, and any form of discrimination.

The draft further requires lenders to develop data protection policies, maintain secure ICT systems, conduct staff screening, and establish formal complaint-handling procedures. All unresolved customer complaints must be addressed within 30 days.

CBK said the regulations aim to create a fair, transparent, and inclusive credit market that promotes responsible lending and protects borrowers from exploitation.