Digital Lenders Finally Gagged from Threatening Customers in New CBK Regulations

Online lenders should have at least one physical office according to the provisions of the CBK Amendment Bill, 2021.

CBK Governor Patrick Njoroge

As we had reported before, the CBK Amendment Bill, 2021 has since been signed into law by the President of Kenya. This means that online lenders will now be policed by the CBK, and there are a ton of regulations that they have to subscribe to else they get punished for malpractice.

The law is effective as of today, Dec 23, 2021. This means that the CBK has already prepared a draft Digital Credit Providers Regulations, which the public can look into and submit their input.

The new law requires the CBK to publish the regulation in three months, which means that the draft should become effective by March 23, 2022. The regulations cover the licensing, governance, and credit operations of online lenders or Digital Credit Providers (DCPs).

The regulations further provide for consumer protection, credit information sharing, and elaborate anti-money laundering and combating for the financing of terrorism obligations to digital lenders.

Here are parts of the draft regulations:


The regulations state that no person shall establish or carry out digital credit business in Kenya or otherwise hold himself out as carrying out digital credit business unless licensed under the amendment.

Any person who contravenes the provisions of the preceding regulation commits an offense and shall be liable upon conviction to a fine of five hundred thousand shillings or imprisonment for a term of two years or to both.

Any person who was at the commencement of these regulations conducting digital credit business which is not regulated under any other written law shall apply to the CBK for a license within six months of publication of these Regulations.

NOTE: Many online lenders have not been registered because there was no law stopping their operations. This means that they will have to register their lending operations afresh and abide by the stated laws.


A digital lender shall put in place appropriate policies, procedures, and systems to ensure the confidentiality of customer information and transactions.

An online credit provider shall not share customer information with any person without the customer’s consent.

 Directors, officers, employees, and agents of a digital credit provider shall protect the confidentiality of customer information and transactions.

No director, officer, employee, or agent of a digital credit provider shall during, or upon, and after the termination of engagement or employment with the digital credit provider (except in the proper course of his duty and or with the digital credit provider’s written consent) divulge or make use of any secrets, copyright material, or any correspondence, accounts of the digital credit provider or its customers.

Customer Consent

A digital credit provider shall ensure that the customer’s consent is obtained before the submission or sharing of credit information with a credit reference bureau.

A customer may give consent through oral, print, or electronic means, subject to the satisfaction of the digital credit provider as to the authenticity of the electronic consent.

A digital credit provider who furnishes negative information to a bureau with respect to a customer shall, in writing or through electronic means, notify the customer of the intention to submit the negative information at least thirty days before submitting the negative information to the bureau or within such shorter period as the contract between the digital credit provider and the customer may provide.

A digital credit provider who has furnished credit information to a bureau shall, within thirty days from the date the information was furnished to a bureau, notify the customer that the customer’s credit information has been forwarded to the bureau.

Place of Business

Online lenders should have at least one physical office according to the provisions of the bill.

No branch or place of business of a digital credit provider shall be opened, relocated, or closed without the prior written approval of the Central Bank.

Credit Collection

This has been an issue for the majority of Kenyans who have been harassed by debt collectors, some of whom go to the extent of insulting them or calling members of their families to shame them for not repaying loans in a timely manner.

To this end, the CBK states that a digital credit provider, its officers, employees, or agents shall not in the course of debt collection engage in any of the following conduct against the customer or any other person:

  • use of threat, or violence or other criminal means to physically harm the person, or his reputation or property;
  • use of obscene or profane language;
  • make unauthorized or unsolicited calls or messages to a customer’s contacts;
  • improper or unconscionable debt collection tactic, method or conduct.
  • any other conduct whose consequence is to harass, oppress, or abuse any person in connection with the collection of a debt.

These regulations, among others, that you can read here, protect the consumer from harassment from online lenders. The regulations, and the CBK Amendment Bill, 2021 also ensure that credit lenders are running a legitimate business, and are backed by the law to run their operations under guidelines that protect them and their customers.

You can submit your comments to [email protected]