Digital lenders in Kenya: identity, licensing and data protection

Until 2021 most Kenyan lending apps were unregulated. The CBK (Amendment) Act, 2021 changed that by requiring digital credit providers to be licensed by the Central Bank, and the Digital Credit Providers Regulations, 2022 set out how they must operate. The Business Laws (Amendment) Act, 2024 then widened the CBK's remit to non-deposit-taking credit providers, including buy-now-pay-later.

Identity is the first credit check

A lender that cannot prove who it lent to cannot collect fairly, report accurately to credit bureaus, or defend itself when someone says the loan was taken in their name. Identity fraud in digital lending usually looks like this:

• Stolen national IDs used to open loan accounts.
• SIM swap used to take over an existing borrower's number and wallet.
• Synthetic identities that build a short history and then default.
• One person borrowing across several apps under different identities.

Data protection is not optional

The Office of the Data Protection Commissioner has fined digital lenders for using borrowers' phone contacts to shame them over debts. The lesson for onboarding is to collect only what the loan decision needs, get clear consent, and keep identity data secure and for no longer than required.

A practical checklist

• Verify the ID document and match it to a live selfie before the first disbursement.
• Screen applicants against sanctions and PEP lists.
• Re-verify when the phone number, device or payout account changes.
• Record every check and decision so disputes and CBK reviews can be answered from evidence.