Kenya licensed digital lenders. Now it must supervise the loan.

A borrower asked a lender for KSh300,000 against a vehicle logbook and received KSh200,000. The difference went on what the Competition Authority of Kenya (CAK) describes as "re-insurance cost and undisclosed fees". Within five months the balance had reached KSh500,000. The lender then classified the loan as non-performing, which CAK calls "a false claim", attached the vehicle and sold it at auction. CAK's director of policy and research, Adano Roba, and its consumer protection manager, Boniface Kamiti, set out the case on the authority's website. They do not name the lender or say whether it held a Central Bank of Kenya (CBK) licence.

On 18 August 2026 a petition from boda boda riders against Mogo Auto Limited reached the National Assembly. The Speaker, Moses Wetang'ula, asked the committees handling it to establish whether such lenders "𝒂𝒓𝒆 𝒍𝒊𝒄𝒆𝒏𝒔𝒆𝒅 𝒃𝒚 𝒕𝒉𝒆 𝑪𝒆𝒏𝒕𝒓𝒂𝒍 𝑩𝒂𝒏𝒌 𝒐𝒇 𝑲𝒆𝒏𝒚𝒂 (𝑪𝑩𝑲). 𝑰𝒇 𝒕𝒉𝒆𝒚 𝒂𝒓𝒆, 𝒘𝒉𝒆𝒕𝒉𝒆𝒓 𝒕𝒉𝒆 𝑪𝑩𝑲 𝒓𝒆𝒈𝒖𝒍𝒂𝒕𝒆𝒔 𝒕𝒉𝒆𝒎."

They are licensed, and CBK does regulate them. Its rules already ban contact-list harassment, require disclosure of the annual percentage rate (APR, the yearly cost of a loan including fees), cap what a lender can recover on a bad loan and require CBK's written approval for any change to a lender's pricing model. The rules that would end charges for early repayment, bar forced bundling and let CBK change a lender's prices have been in draft since 7 August 2025. Nothing in force or in draft deals with the surplus from a seized asset or the lock on a financed phone. And the published sanctions against digital lenders have come from the data protection regulator, the competition authority and the courts. 𝐏𝐫𝐞𝐜𝐮𝐫𝐬𝐨𝐫 𝐟𝐨𝐮𝐧𝐝 𝐧𝐨𝐧𝐞 𝐩𝐮𝐛𝐥𝐢𝐬𝐡𝐞𝐝 𝐛𝐲 𝐂𝐁𝐊.

Licences and complaints.

On 30 September 2026 CBK announced 29 more licences, taking the roster of digital credit providers to 281. Licensed lenders had made 9,596,509 loans worth KSh165.1 billion by August 2026, CBK said, an average of about KSh17,200 a loan (KSh165.1 billion divided by 9,596,509). Licensing began with the CBK (Digital Credit Providers) Regulations 2022, published on 18 March 2022 under powers Parliament granted in December 2021. The Business Laws (Amendment) Act 2024, in force since 27 December 2024, widened CBK's remit to all non-deposit-taking credit business, including asset finance and buy now, pay later (BNPL) schemes, but excluding hire purchase agreements.

Complaints grew over the same period. CAK received 355 complaints against digital lenders in the year to June 2025, against 67 the year before, Business Daily reported on 15 July 2026. They made up 355 of the 564 financial services complaints CAK handled, or 63 percent, according to WeeTracker's account of the same data, and concerned misleading representations, undisclosed charges and unilateral changes to loan terms. Business Daily also listed premature asset seizure.

The riders' petition came from Charles Gichira, national executive chairperson of the Kenya Bodaboda Riders and Owners Association. It alleges that Mogo, which CBK licensed on 27 June 2024, imposes "excessively high interest rates and other charges", that its disclosure of loan terms is "inadequate" and that "motorcycles are repossessed immediately upon default". No committee report has been tabled.

The price of a short loan.

Licensed lenders' own disclosures now show four-digit rates. Kashbean, an app run by Creditarea Capital Limited, which CBK licensed on 6 March 2024, states a representative APR of 425 to 1,600 percent on its Google Play listing, updated on 26 June 2026, for loans it says can run up to 91 days. Koro, an app whose Play Store developer is Zenka Digital Limited, licensed on 27 March 2023, lists a maximum effective APR of 4,432 percent and a minimum of 30 percent in a listing updated on 31 August 2026. Each lender filed its pricing model with CBK to obtain its licence, and regulation 29 of the 2022 regulations bars any change to that model without CBK's written approval.

The representative examples in the same listings are lower. Kashbean's KSh10,000 loan over 61 days costs KSh4,500 in interest, about 269 percent a year simple (45 multiplied by 365, divided by 61), below the bottom of its own stated range. Koro's KSh1,000 loan over 61 days costs KSh390, about 233 percent. Neither listing explains its upper figure.

The arithmetic of a flat charge shows how such figures arise. A 10 percent fee on a 30-day loan is an APR of about 122 percent (10 multiplied by 365, divided by 30). If the borrower repays after seven days and the fee stays the same, the rate on the money used is about 521 percent. Koro's listing gives an interest fee of 2.45 to 39 percent. On Precursor's calculation, a 39 percent charge reaches 4,432 percent a year if it is earned over about three days (39 multiplied by 365, divided by 4,432, gives 3.2 days).

Google, not CBK, sets the minimum term for app lending. Since 31 January 2023 the Play Store has required Kenyan loan apps to hold a CBK licence, and its global policy excludes apps that promote personal loans "which require repayment in full in 60 days or less". Both listings comply with a first term of 61 days. Koro then lets borrowers "postpone your due date by 7, 14, or 30 days" and does not state the charge for doing so in its listing. CBK's rules set no minimum term and no ceiling on price.

Short use of a longer loan is common. When CAK analysed administrative data from eight providers for January 2019 to March 2020, before licensing, it found that 37.5 percent of accounts had an average effective tenure under four weeks and 5.1 percent a week or less, although contracted terms ran to 30 days. It calculated a mean effective APR of 280.5 percent and a median of 96.5 percent. Only 40 percent of borrowers could recall the cost of their last loan to within 5 percent.

The four-digit figures are visible because regulation 27 of the 2022 regulations obliges a lender to state "the total cost of credit" and "the annual percentage rate of interest" before lending. No rule limits them. The draft Non-Deposit Taking Credit Providers Regulations, which CBK published for comment on 7 August 2025 and still lists as a draft, would go further. Draft regulation 49(4) says a borrower who repays in full early "shall not be required to pay interest for the remaining period to maturity", though it does not say whether that covers a flat facility fee. Draft regulation 53(b) would require advertising to say whether a rate is "per annum or per month", and draft regulation 55(3) would let CBK "change the pricing parameters" of a lender "for reasons to be stated".

The price of a financed asset.

Asset finance shows the same pattern at larger sums. Mogo's Play Store listing, updated on 13 July 2026, states a maximum APR of 270.24 percent for its boda boda logbook loans, which lend cash against a motorcycle the borrower already owns. Watu Credit's Kenya country manager, Eric Massawe, told the National Assembly finance committee in May 2024 that Watu charged 8.6 percent a month. That is 103.2 percent a year simple, or about 169 percent compounded. Watu's 2020 terms, which its website marks "Old", set a late penalty of 0.5 percent a day, or 182.5 per cent a year before compounding, and state that early repayment "does not affect the amount of Interest payable".

Lenders' strongest answer is cost and risk. A small loan carries fixed costs for underwriting, disbursement and collection that a percentage rate magnifies, and lending to informal workers against motorcycles that depreciate and are stolen defaults more often. Watu's profit fell 85 percent to US$1.2 million in 2024 as impairments rose, according to disclosures by Car and General, which owns 29 percent of it, before rising to KSh4.8 billion in 2025. Parliament repealed Kenya's cap on bank lending rates in November 2019. No licensed lender publishes loss rates by product, so the risk explanation cannot yet be tested against data, in either direction.

The courts have started to set limits case by case. On 2 June 2026 the Thika Small Claims Court, in a judgment by adjudicator Jamlick Muriithi Mwenda, reduced Mogo's claim of KSh677,381 on a KSh400,000 loan made in June 2022 to KSh100,631, People Daily reported. The borrower had repaid KSh299,369. The court applied the in duplum rule, which stops interest accruing once it equals the principal, and described "an effective interest rate of 86.4 percent, exclusive of additional charges" as "nothing short of exploitative". KDRTV reported that the court also rejected monitoring and insurance fees "for lack of justification".

CAK has acted on how such prices are computed. On 4 October 2024 it imposed a penalty of KSh10,851,473.20 on Mogo under the Competition Act's provisions on false or misleading representations and unconscionable conduct. The decision followed four complaints, lodged between May 2023 and April 2024, about loans Mogo made in 2021 and 2022, before it was licensed. In each case a loan disbursed in shillings was computed in US dollars, so the shilling instalments moved with the exchange rate. In two, the interest basis was changed after signing, in one case from a flat 2.5 percent to 3.85 per cent on a reducing balance. One borrower who took KSh300,000 in July 2021 was told after 20 months of payments that KSh392,000 remained. Mogo told CAK that fewer than 15 percent of its customers had chosen the dollar product, The Standard reported. CAK ordered refunds totalling KSh344,939 to three borrowers and fixed the fourth's outstanding balance at KSh500,000.

Collectors and contact lists.

CAK's complaint categories for digital lenders include borrower harassment and abuse of personal information, Business Daily reported in March 2025. Complainants describe repeated calls and messages to borrowers and their contacts, threats, shaming and pressure on people listed as guarantors.

Each practice is banned. Regulation 20 of the 2022 regulations prohibits threats, "obscene or profane language", accessing "the customer's phone book or contacts list" to message them, posting a customer's information online to shame them and "unauthorized or unsolicited calls or messages to a customer's phone contacts". Regulation 26 limits data collection to what is "reasonably required" for appraisal, disbursement and collection.

Enforcement has come mainly from the Office of the Data Protection Commissioner (ODPC). It fined Whitepath, operator of the Instarcash and Zuricash apps, KSh5 million in April 2023 after about 150 complaints about access to contact lists and unsolicited messages. In March 2025 it fined the same company KSh250,000 for listing a man as a guarantor without his consent and subjecting him to collection calls, TechCabal reported. On 26 September 2023 it fined Mulla Pride, operator of the KeCredit and FairKash apps, KSh2,975,000 for using third parties' contact details to send threatening messages. The High Court dismissed Mulla Pride's challenge, The Kenyan Wall Street reported on 8 August 2025.

Regulation 37 lets CBK impose penalties of up to KSh500,000 plus KSh10,000 a day, and to suspend or revoke a licence. Precursor found no CBK press release or gazette notice recording such a penalty, suspension or revocation against a licensed lender since 2022, a gap in the public record rather than proof that CBK has never acted. The Data Commissioner, Immaculate Kassait, has said her office coordinates with CBK and has asked it to deregister non-compliant lenders, The Standard reported in August 2025.

The credit record.

A borrower who repays depends on the lender to tell the credit reference bureaus (CRBs, the three licensed companies that hold borrowers' repayment histories). The Banking (Credit Reference Bureau) Regulations 2020 require a lender to update a bureau "immediately there is a change in the information". Creditinfo, one of the three bureaus, tells customers that a lender takes up to three working days to report a cleared loan and that Creditinfo then takes around two to three working days to update the status, up to six working days in all. It also says the regulations require lenders to submit data at least once a month.

A borrower can dispute an entry through the bureau, which must investigate within seven days. The lender then has 21 days, and if it does not complete its investigation the bureau must delete the disputed entry. Lenders may not report negative information on debts of KSh1,000 or less, and digital lenders must give written notice before listing a borrower, normally 30 days. Negative information stays on file for five years after the debt is settled.

Those rules rest on an interim order. On 28 August 2023 Justice Mugure Thande declared the 2020 regulations void because they had been tabled in Parliament late, which revived the 2013 rules without the KSh1,000 floor. The Court of Appeal reinstated the 2020 regulations pending CBK's appeal, Civil Appeal E782 of 2023, Business Daily reported in February 2024. Precursor found no record of a final decision.

Lenders now have a tool to make submissions consistent. CIS ValiData, built by Credit Information Sharing Kenya with support from FSD Kenya, received CBK approval on 5 August 2025 and launched in September 2025. It checks lenders' submissions against quality thresholds, blocks those that fall short and sends data to all three bureaus at once, which removes one source of conflicting records. It serves lenders submitting data rather than borrowers seeking a correction, and Precursor could not establish whether CBK requires licensed digital lenders to use it.

A listing can cost more than credit. Under the Employment (Amendment) Act 2022, an employer may ask for a CRB clearance certificate only after offering a job, though candidates for state office can be asked earlier. A record that was not updated after repayment can still surface at the point of hiring.

The limits of the licence.

The 2024 amendments brought asset finance and BNPL under CBK. Those products give the lender a power that cash loans do not, because the lender can take or disable the thing the loan paid for.

Watu's published terms show the contractual machinery. Clause 3.8 authorises Watu "at the Lender's discretion to control or switch off the Vehicle remotely" through a GPS tracker fitted at the borrower's cost. Clause 7.1 makes one unpaid weekly instalment an event of default, and clause 7.2 then makes the whole balance, "together with the full Interest amount", payable at once. Those terms are the 2020 version, and current contracts may differ.

The 2022 regulations say nothing about repossessing or selling a financed asset. Seizure and sale fall under the Movable Property Security Rights Act 2017 (MPSRA). It requires a written default notice (section 67) and at least five working days' notice before a sale (section 73), and lets the borrower redeem the asset by paying in full until the sale (section 69). Section 71(2) lets a creditor "render the collateral unusable" without removing it, which describes a remote immobiliser. On the proceeds, section 74(3) says the creditor "may pay the surplus to a court", while section 74(4) keeps the borrower liable for any shortfall. The Act does not state that the surplus belongs to the borrower. Precursor's reading, pending legal opinion, is that a borrower seeking it must rely on general law and a court.

The Hire Purchase Act gives stronger protection. Section 15 bars an owner from recovering goods "otherwise than by action", meaning through a court, once two-thirds of the hire purchase price has been paid. It applies only to hire purchase agreements, and lenders write motorcycle and logbook finance as loans secured on the asset. Precursor's inference is that a borrower who has paid 90 percent under a loan-and-security contract is owed five working days' notice, not a hearing.

The draft regulations would reach part of this. Draft regulation 41 bans "collecting or repossessing physical security using violence and other forms of harassment or intimidation" and "taking away essential personal effects of a borrower", and requires compliance with the MPSRA. Draft regulation 35(3) requires any sale of a borrower's property to be "transparent". Draft regulation 35(2) bars a lender from requiring a borrower "to purchase another product as a pre-condition", which would appear to cover compulsory insurance unless lenders argue that cover protecting their collateral is part of the loan. The draft sets no arrears threshold before seizure, no rule on the surplus and nothing on remote locking.

Phone financing depends on that lock. Lenders that sell smartphones on credit can disable a handset when payments lapse, and The Standard has reported both on borrowers bypassing locks and on prosecutions for illegal unlocking. Neither the 2022 regulations nor the draft sets notice, emergency access or unlock timelines for a locked device.

The cost of repeat borrowing.

CAK's pre-licensing survey found that 33 percent of mobile borrowers held more than one loan at once before March 2020, rising to 44 percent after the pandemic began. Among borrowers with accounts at several providers, 95.8 percent took a new loan within 30 days of a previous one. 77% of mobile borrowers reported failing to repay a loan at least once. No comparable data from the licensed period has been published.

Current data comes from outside the licensing regime. Fuliza, the M-Pesa overdraft that NCBA and KCB provide under banking law rather than the digital credit rules, disbursed KSh1.47 trillion in Safaricom's year to March 2026 to 17.7 million customers, Techweez reported. The average draw was KSh217.9, against KSh622.7 in the year to March 2020. Smaller, more frequent borrowing by more people is consistent with credit used to bridge daily shortfalls.

Three regulators and a court.

Enforcement is split between three regulators and the courts. ODPC fines lenders over data. CAK collects complaints, penalised Mogo KSh10.85 million and has intervened to have disputed charges waived by African Capital Limited, according to WeeTracker. The courts have refused to enforce unlicensed lending and have cut licensed lenders' claims. In March 2025 the Small Claims Court dismissed 139 recovery claims filed by digital lenders holding that "the court cannot dignify an illegality by presiding over such matters". Lenders describe the same overlap from the other side. Kevin Mutiso, chair of the Digital Financial Services Association of Kenya, said in August 2025 that "we worry about regulatory overreach by CBK".

The Joint Financial Sector Regulators issued a draft Financial Consumer Protection Framework in March 2026, a statement of principles that does not bind lenders. Precursor found no published complaints count combining CBK, CAK and ODPC data by lender.

The evidence for financial education as a substitute for product rules is weak. A 2014 meta-analysis of 201 studies by Daniel Fernandes, John Lynch and Richard Netemeyer found that financial education explained about 0.1 percent of the variance in the financial behaviours studied, with weaker effects in low-income groups and effects that faded within about 20 months. CAK's finding that only 40 percent of borrowers could recall what their last loan cost points the same way. A rule on product design, such as free early repayment or a ban on forced bundling, works whether or not the borrower reads it.

The changes that follow.

First, CBK should finalise the non-deposit-taking regulations, now 14 months in draft, and add what the draft omits. That means payment of any sale surplus to the borrower within a fixed period, a minimum arrears threshold and independent valuation before seizure, notice and emergency access before a device is locked, and a deadline in days for reporting repayment to the bureaus. It should state whether free early repayment applies to flat fees.

Second, Parliament should amend section 74 of the MPSRA so that any surplus belongs to the borrower, and extend the Hire Purchase Act's two-thirds court requirement to consumer and micro-business asset finance, whatever the contract is called.

Third, CBK should publish the price range it has approved for each licensee and require that a lender's published maximum APR reconcile with its own representative example. CBK, ODPC and CAK should publish their enforcement actions against licensed lenders and a joint complaints count by lender.

Had the draft applied to the lender in CAK's case, it could not have recovered charges it never disclosed (draft regulation 41(2)), and its sale of the vehicle would have had to be transparent. Under no rule in force or in draft would the balance from that auction have been the borrower's by right. Two decisions will show whether that changes. One is whether CBK gazettes the non-deposit-taking regulations before the joined committees report on the Mogo petition. The other is whether the Court of Appeal upholds the 2020 credit bureau rules on which every listing now depends.

Today's lender must hold a licence and obey disclosure and collection rules. The borrower still needs a usable statement, a fair chance to challenge the balance before sale and a full account of what happens to the asset and its proceeds. Those are outcomes a licence can be judged against.