The Regulation of Digital Lending in Kenya

Background

The Central Bank on 18 March 2022 operationalized the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 according to the Central Bank the mandate to regulate Digital Credit Providers in Kenya. The regulations are to apply to entities wishing to carry out credit facilities or loan services through a digital channel in Kenya, which includes the regulation of the previously unregulated Non-Deposit Taking Credit Microfinance Institutions. The digital channels mentioned are such as mobile phones, the internet, computers, and apps.

Introduction

The importance of the regulation of Digital Credit Providers is that it primarily affords security and protection to borrowers or those considering seeking these services.

In ensuring this, the CBK requires digital credit providers to have processes and introduce channels and pricing that ensure both data and consumer protection to the benefit of the user.

This can also be evidenced through the requirement of functions that ensure business continuity where the Digital Credit Provider is expected to put in place sound systems and processes for purposes of ensuring continuity and minimizing disruptions.

Digital Credit Providers are also expected to use systems that are secure and reliable, and those that ensure information confidentiality, integrity, and availability. In being more consumer-facing, digital credit providers are required to have consumer redress mechanisms for the consumers of their products to have ready channels to express their grievances.

The Central Bank of Kenya expects digital credit providers to have internal policies and procedures tailored to the Digital Credit Providers Regulation and other relevant regulations to guide stakeholders of the entity in their conduct.

These policies include the mentioned Consumer Redress Mechanisms, Data Protection Policies and Procedures, Money Laundering and Combating Financing of Terrorism Policies and Procedures, Corporate Governance Policy, and Code of Ethics and Market Conduct.

The ball is also placed in the Digital Lender’s court in some areas, where the bank mandates DCPs with the task to conduct due diligence to ensure that they do not advance credit to customers before taking reasonable steps to assess the customer’s ability to repay the credit.

The CBK is key to ensuring that these financial institutions have sound corporate governance principles based on ethics and integrity, good reputation and legitimacy, sound risk management, and compliance with the law.

Entities not regulated by the Digital Credit Providers Regulations, 2022

These regulations are to affect the digital credit providers and do not apply to the following:

• Institutions licensed under the Banking Act;
• Institutions licensed under the Microfinance Act, 2006;
• Saccos Societies licensed under the Sacco Societies Act, 2008;
• Kenya Post Office Savings Bank is supervised under the Kenya Post Office Savings Act;
• Credit Arrangements whereby the provision of credit by a person by the way of Sale of Goods or in the provision of services by the person whose primary business is the provision of goods or services;
• An entity whose digital credit business is regulated under any other written law;
• Any other entity approved by the CBK

Licensing of Digital Credit Providers in Kenya

Any person who wishes to carry out the Digital Credit business in Kenya should then apply to the CBK for a Digital Credit Provider License under these regulations. The license serves as an assurance that the Regulator has recognized and approved the DCP as a credible entity to conduct the digital credit business having fulfilled all the regulatory and statutory requirements. In doing so, the CBK shall consider the following:

• The history of the applicant entity
• The professional and moral suitability of the persons proposed to manage or control the Digital Credit entity

• The sources and evidence of funds to be invested in the Digital Credit Provider

• The adequacy of the entity’s systems, policies, and procedures
• The Governance and risk management systems of the entity
• Public Interest.

The License is renewable every year on or before  December 31 and is to remain valid unless suspended or revoked by the CBK. The CBK will ensure that the name and address of the licensed DCP shall be published on the Gazette and CBK’s website within 30 days of the grant of the license.

Note that, the DCP license is not transferable and cannot be assigned or encumbered.

Entities that fail to comply with the Digital Credit Provider Licensing regulations may incur administrative sanctions from the CBK. The sanctions are such as monetary penalty on the entity, its directors, officers, or employees responsible; suspension from office of the defaulter; disqualification from holding office or position in any licensed or financial institution in Kenya; frequent inspection; an order to submit a plan to resolve all deficiencies to the CBK; suspension or revocation of license and any other action that they CBK may consider appropriate.

Grounds of Revocation or Suspension of DCP License

The Central Bank as the Regulator reserves the right to suspend or revoke a license of a digital credit provider on the following grounds:

1. Where the DCP does not meet or has gone against any licensing conditions
2. Where the DCP fails to pay the annual fees or a monetary penalty imposed by the CBK
3. Where the DCP is found to have provided false information during the license application
4. Where the DCP ceases to carry out the business of a digital credit provider
5. Where the DCP goes into liquidation or an order is issued for its winding up;
6. Where the DCP violates anti-money laundering laws or combating the financing of terrorism laws;
7. Where the DCP has gone against any of the provisions of the Act or any regulations relating to digital lending; or
8. Where the DCP otherwise conducts its business in a manner detrimental to the interests of its customers or members of the public.

However, in the spirit of fair administration, the Central Bank will give the entity responsible a chance to be heard before suspending or revoking their DCP license.