Kenya (KE)

Licensing, Authorisation & Market Access

Kenya runs a mature, single-tier non-bank PSP authorisation regime administered by the Central Bank of Kenya under the National Payment System Act 2011 and the NPS Regulations 2014. The framework defines four PSP categories — Electronic Retail Payment Service Provider, Designated Payment Instrument Issuer, E-Money Issuer, and Small E-Money Issuer. Section 12 of the NPS Act prohibits the conduct of PSP business without CBK authorisation. Critically for non-bank payment institutions and e-money issuers, there is no EMI or PI passporting, and the CBK does not recognise other central banks' licences: each applicant must be locally incorporated and separately CBK-authorised. Banks, by contrast, are licensed under the Banking Act (Cap 488), a distinct prudential track from the non-bank PI/EMI regime described here.

The First Schedule sets category-tiered core-capital thresholds: KES 5,000,000 for an electronic retail PSP, KES 50,000,000 for a designated payment instrument issuer, KES 20,000,000 for an e-money issuer, and KES 1,000,000 for a small e-money issuer. The full authorisation process typically runs four to nine months. Unlicensed PSP operation is illegal, and enforcement against unlicensed operators has been intensifying since 2023.

The analytical takeaway is that the binding market-access constraint is structural, not financial. The capital floors and four-to-nine-month timeline are a direct cost-of-entry signal for fintech operators, but the determinative barriers are the mandatory local-incorporation requirement and the non-recognition of foreign licences, which together bar any licence portability into the Kenyan market. Any non-bank payments operator entering Kenya must therefore build a locally incorporated, CBK-authorised entity from the ground up.

Outlook

The W1a baseline is Confirmed and trajectory established; the regime is mature and stable. Forward watch items concentrate in adjacent modules — the in-force VASP Act licensing categories (W2) and any national-switch licensing implications (W5) — rather than in the core NPS Act framework itself, which is not expected to shift in the near term.

Stablecoins & Digital Money

The defining digital-money development for Kenya is the Virtual Asset Service Providers Act 2025, assented in October 2025 (Act No. 20 of 2025, gazetted 21 October 2025) and in force from 4 November 2025. The Act establishes a dual-regulator model that crosses the bank and non-bank lines: the CBK licenses payment-related virtual assets — stablecoin dealers, virtual asset wallet providers, virtual asset payment processors and stablecoin-issuance providers — while the Capital Markets Authority supervises exchanges, brokers and tokenisation platforms. The Act brings stablecoin payment rails into a supervised perimeter.

The central commercial gap is between the in-force Act and its still-draft implementing regulations. Draft National Treasury VASP Regulations 2026 set the heaviest capital requirement on stablecoin issuers at KES 500 million (~USD 3.8m), counting only fully paid-up funds, with licensing fees ranging from KES 100,000 to KES 2 million (the highest on exchanges and stablecoin payment processors) and joint CBK/CMA oversight aligned to FATF AML/CFT standards. Consultation closed on 10 April 2026, but the regulations were not confirmed gazetted as of 24 June 2026, and no VASP had been licensed. For these reasons confidence is held at Assessed, with an explicit pending caveat, rather than High.

Outlook

The W2 trajectory is escalating. The key forward signal is finalisation and gazette of the VASP Regulations 2026, expected in the second half of 2026, which would operationalise the licensing categories, the ~KES 500m stablecoin-issuer capital floor and the reserve rules. Whether gazette and licensing commencement have occurred is an explicit gap flagged for diffing against the first periodic run; emerging-market crypto-rule operationalisation is under-indexed and should be re-confirmed next cycle.

Correspondent Banking, Settlement & Access

The analytical spine of this structural module is the bank versus non-bank access asymmetry at the settlement layer. The Kenya Electronic Payment and Settlement System (KEPSS) is Kenya's Real Time Gross Settlement system, where transactions are cleared and settled continuously with commercial banks holding settlement accounts at the CBK. Non-bank PSPs do not access KEPSS directly; they settle via banks holding KEPSS accounts — a structural dependency for fintech settlement. Bank licensing, including foreign-bank subsidiary or branch entry, sits under the Banking Act (Cap 488), with additional scrutiny and longer approval where the parent sits in a FATF grey- or black-list jurisdiction.

At the cross-border layer, correspondent-banking access is under de-risking pressure amplified by FATF grey-listing and EU high-risk listing, triggering enhanced due diligence, manual review queues that add days to settlement and more expensive trade finance. The WPM lens here is narrowly on settlement and access friction; the root AML dynamics are carried via the W11 Sentinel feed and routed to FIM. The strategic response is PAPSS local-currency settlement, explicitly designed to reduce reliance on USD correspondent chains — making PAPSS adoption (W5) the direct commercial mitigation for de-risking-driven settlement latency and cost.

Outlook

The W12 trajectory is escalating. The structural watch item is the pace of PAPSS uptake against continued de-risking pressure; an AML status improvement (W11/FIM) or deeper PAPSS integration would ease the settlement-access constraint, while grey-list retention sustains it.

Commercial Intelligence (M&A, Investment & Product)

The W13 commercial picture is dominated by a single bank-into-fintech vertical-integration pattern led by KCB Group, rendered here as two discrete M&A events.

First, a completed deal: in March 2025 KCB acquired a 75% controlling stake in Riverbank Solutions for about KES 2 billion (~USD 15.4m, disclosed value), bringing agency-banking, revenue-collection and payments infrastructure into the group as the first leg of its full-stack payments platform strategy.

Second, a pending deal: on 31 October 2025 KCB announced an agreement to acquire a minority stake in CBK-licensed PSP Pesapal Limited — value not publicly disclosed — subject to regulatory approval, to deepen its push into merchant acquiring and SME payments. As of an 11 March 2026 investor briefing the deal was still awaiting regulatory approval. Pesapal is licensed across Kenya, Uganda, Tanzania, Rwanda and Zambia, so the transaction would extend KCB's reach across five East African markets. Together these events confirm a bank-into-fintech vertical-integration pattern: traditional lenders moving into merchant acquiring and regional payment rails.

Outlook

The W13 trajectory is escalating. The key forward signal is CBK regulatory approval of the KCB-Pesapal minority stake, expected in 2026; the deal value remains undisclosed and the completion date is not yet available. Private-company deal terms are under-indexed and the completion and any disclosed value should be tracked next run.

Consumer Protection & APP Fraud

The forward-looking consumer-protection signal is the CBK's plan, developed under the Kenya National Financial Inclusion Strategy 2025-2028 with the Competition Authority, to establish formal compensation rules for e-money and digital-wallet fraud. It is committed for implementation by end-2026 and would add digital complaint systems, pricing transparency and provider capacity-building. Crucially, no UK-PSR-style mandatory APP-fraud reimbursement regime is in force yet — this is a pending framework, against a backdrop where FinAccess 2024 found 9.8% of mobile-money users experienced direct fraud loss, well above banking channels. A mandatory fraud-redress regime would shift liability onto mobile-money providers and materially alter fraud-cost economics.

The in-force complement is the CBK Digital Credit Providers Regulations 2022 (gazetted March 2022), which placed digital lenders under oversight — roughly 227 DCPs licensed by early 2026, up from an initial 85 of more than 700 applications. This is strengthened by the Business Laws (Amendment) Act 2024/2025, which bans harassment, and the in-duplum rule (s.44A) caps interest and penalties at the principal once doubled, with fines up to KES 500,000 or licence revocation. Consumer complaints reportedly fell from around 4,000 a month to a handful. DCP licensing, the interest cap and the harassment ban reshape unit economics and conduct risk for the non-bank digital-lending segment.

Outlook

The W10 trajectory is escalating. The key pending instrument to diff each periodic run is the e-money/digital-wallet fraud compensation framework, targeted for end-2026 with a year-band uncertainty; whether it is implemented and on what liability model is the principal watch item.

AML/CFT & Financial Crime (Sentinel-fed)

This module is sourced from the Sentinel feed; WPM carries the payments-context impact only and does not re-analyse illicit finance. Per the Sentinel-fed FATF record, Kenya is a jurisdiction under increased FATF monitoring (grey list), placed in February 2024 and retained through the June 2026 plenary cycle, working with FATF on an agreed AML/CFT/CPF action plan. Kenya is also on the EU high-risk third-country list (added 10 June 2025). For payments, the consequence is enhanced due diligence and correspondent-banking de-risking pressure on Kenyan flows. (Source: FATF country detail, via Sentinel feed.)

On remediation, also via the Sentinel feed: on 17 June 2025 President Ruto signed the AML and Combating of Terrorism Financing Laws (Amendment) Act 2025 to address FATF-cited deficiencies — enhancing Financial Reporting Centre oversight, mandating enhanced due diligence on high-risk customers and PEPs, stricter KYC and more frequent STR reporting. POCAMLA (Cap 323, 2009) remains the primary AML statute establishing the FRC; the NPS Regulations 2014 carry AML obligations for mobile-money providers; and VASPs are reporting institutions under the VASP Act. The payments-context impact is the KYC and STR burden; deeper illicit-finance analysis is routed to FIM.

Outlook

The W11 trajectory is escalating, with grey-list status retained and remediation underway. Original grey-list-exit assessment and illicit-finance dynamics belong in FIM via the cross-monitor flag; WPM tracks only the EDD and de-risking spillover into settlement and access (see W12).

Conduct, Safeguarding & Financial Promotions

Safeguarding of customer funds in Kenya runs through a mandatory bank-trust model. Non-bank PSPs must establish a trust with a CBK-licensed bank to hold customer and e-money funds, supported by a trust deed required under the NPS Act. This determines where the float sits and the insolvency-remoteness of customer funds for Kenyan e-money issuers. Conduct is layered by the Consumer Protection Act 2012, the Data Protection Act 2019 and POCAMLA, with data-controller registration and a Fit-and-Proper assessment also required of applicants.

On promotions and agent conduct, the NPS Regulations 2014 carry two material provisions. Regulation 7 requires CBK approval of any proposed product name before use. Regulation 17 governs the appointment of agents and cash merchants, who must comply with POCAMLA 2009 and the Prevention of Terrorism Act 2012. An e-money holder is defined as a person with a redemption claim on an e-money issuer, and the regime carries an aggregate monthly load-limit framework for e-money. This is the conduct counterpart to the W1a licensing track, and it applies squarely to the non-bank PI/EMI segment rather than to banks.

Outlook

The W1b baseline is Confirmed and established. The principal open question is legal-infrastructure depth: the settlement-finality and insolvency treatment of safeguarded e-money funds held under the bank-trust structure is not fully resolved in available sources and warrants deepening in periodic runs.

Operational Resilience & Critical Infrastructure

Operational resilience for non-bank PSPs in Kenya is anchored in the CBK Guideline on Cybersecurity for Payment Service Providers (July 2019), issued under section 31(2)(b) of the NPS Act. The guideline mandates board-level cyber governance, a non-outsourceable CISO, written policies, third-party and dependency risk management, a 24-hour incident-notification obligation to the CBK and quarterly incident-handling reporting. Banks follow a separate 2017 Guidance Note, maintaining the bank/non-bank distinction at the resilience layer. No consolidated DORA-equivalent statute has been identified; resilience runs through the cyber guideline and ICT risk-management guidelines rather than a single instrument, a gap relative to EU peers.

The live operational event is Safaricom's migration of M-Pesa to a new modular core branded 'Fintech 2.0', completed in a maintenance window on 22 September 2025 in a roughly three-hour cutover from the prior G3 architecture — the most significant platform upgrade since 2015, designed to lower system-wide outage risk. As a dashboard-tier dated item: M-Pesa is de facto critical national payment infrastructure, handling transaction activity equivalent to roughly 8% of GDP, so a core re-platform materially affects system-wide resilience and integration capacity. KEPSS remains the systemically important RTGS underpinning settlement.

Outlook

The W3 trajectory is stable. The standing watch item is whether a consolidated DORA-style operational-resilience instrument emerges; none is in force per the absent-field provenance, and the current regime rests on the 2019 cyber guideline.

Scheme & Network Compliance

Card-scheme compliance in Kenya operates through the global Visa and Mastercard rulebooks and PCI DSS, enforced via acquirers. Visa's consolidated Acquirer Monitoring Program (VAMP) took effect on 1 April 2025, with tighter thresholds from January 2026 and merchant assessment from October 2025; Mastercard's Site Data Protection programme applies in parallel. These scheme rules flow down to Kenyan acquirers — both bank-led and non-bank gateways — and interchange is governed by scheme rules rather than statute. No domestic interchange-cap regulation comparable to the EU Interchange Fee Regulation has been identified.

Concrete evidence of the scheme/PCI stack in operation comes from Pesapal, a non-bank PSP that is PCI-DSS Level 1 certified and PCI-PIN compliant, demonstrating that Kenyan card-acquiring PSPs operate under the full scheme and PCI compliance stack, including PIN security across the card-processing cycle. The commercial significance is that the January 2026 VAMP threshold tightening raises chargeback and fraud-ratio compliance pressure on Kenyan acquirers without any domestic interchange backstop to cushion the economics.

Outlook

The W4 trajectory is escalating, driven by scheme-rule tightening rather than domestic regulation. The standing gap is whether any national-switch or FPS rollout introduces domestic interchange or pricing rules; none is in force today, and interchange remains scheme-governed.

Payment Corridor Dynamics

The material corridor development is the integration of Pesalink with PAPSS. Announced on 26 February 2026, Pesalink became a PAPSS Technical Connectivity Provider, connecting 80+ Kenyan bank, fintech, SACCO and telco participants to 160+ commercial banks and fintechs on PAPSS and enabling instant 24/7 cross-border payments settled in local currencies. Kenya, via the CBK, is the 10th African central bank on PAPSS. The strategic effect is to displace USD correspondent chains for intra-African flows, addressing the friction of intra-African remittance costs that averaged 7-8% in 2023 with 3-7 day settlement.

On the domestic instant-payments side, the CBK is advancing a Fast Payment System (FPS / national switch) for real-time 24/7 transactions, originally targeted to launch in 2025. In 2025 Safaricom and the Kenya Bankers Association proposed designating Pesalink as the lead FPS. Launch status as of 24 June 2026 is not confirmed, and industry sources from January 2025 suggested the build could take up to four years; the claim is held at Assessed with a currency-lens caveat. A national FPS would open the closed M-Pesa-dominated ecosystem and reshape interoperability economics, but timeline slippage keeps the structural status quo in place.

Outlook

The W5 trajectory is escalating on the cross-border axis (PAPSS live) and stable on the domestic axis (FPS pending). The forward watch item is FPS go-live, expected in 2026 but with a multi-year uncertainty band; emerging-market instant-payment-rail launch timelines are under-indexed and should be verified in periodic runs.

Industry Structure & Commercial Dynamics

Kenya's payments market structure is a near-monopoly mobile-money ecosystem. Per Communications Authority Q1 FY2025/2026 statistics, M-Pesa holds approximately 89.7% mobile-money market share against Airtel Money's roughly 10.3%, with 48.6 million mobile-money subscriptions and around 91-93% penetration. M-Pesa, a non-bank operator, handles transaction activity equivalent to roughly 8% of Kenya's GDP and processes over 61 million transactions daily, anchoring a long-criticised closed ecosystem. Banks participate via telco-partnered products such as M-Shwari, KCB M-Pesa and Fuliza, and through the bank-owned Pesalink rail.

The structural condition is that single-operator dominance defines competitive dynamics, and closed-ecosystem incumbency is precisely what the CBK's FPS and national-switch agenda targets. The judgment is that the FPS and the Pesalink-led instant-payments agenda are the principal levers to open the market, but FPS timeline slippage preserves the incumbent's position.

Outlook

The W6 trajectory is stable. The market-opening dynamics are dependent on developments tracked in W5 (FPS, Pesalink-PAPSS) and W9 (product access); absent FPS go-live, the structural concentration persists.

Legal & Litigation

Two litigation clusters define the W7 picture. First, a landmark 2022 High Court decision extended the PSP definition to companies utilising SWIFT banking infrastructure, meaning back-end processors may require licensing. In July 2022 the CBK cautioned banks against dealing with Flutterwave and Chipper Cash as unlicensed, and at the end of 2023 issued a cautionary notice against unlicensed fintechs. The broad judicial reading pulls infrastructure and back-end processors into the licensing perimeter, a material market-access risk for cross-border fintechs serving Kenya. T3-only sourcing keeps this at Assessed.

Second, the Office of the Data Protection Commissioner (ODPC) has enforced against digital lenders as a financial-promotion proxy: it fined White Path Company Ltd KES 5m over roughly 150 complaints involving contact-mining and unsolicited messages, and Mulla Pride Ltd (apps KeCredit and FairKash) KES 2.9m for using third-party-obtained contacts to shame borrowers. In Mulla Pride Ltd v ODPC (Petition E420 of 2023) [2025] KEHC 11287, the entity was found to have operated without a CBK licence. From January 2025, debt-shaming and harassment is criminal, with the CBK able to suspend licences and gazette offenders. This raises conduct and compliance cost for the non-bank digital-credit-provider segment.

Outlook

The W7 trajectory is stable on the PSP-scope litigation and escalating on data-protection enforcement against digital lenders. Both clusters remain at Assessed given T3-only sourcing; deeper case-law confirmation would strengthen calibration in future runs.

Merchant Acquiring & Risk

Kenyan merchant acquiring spans bank-led acquiring (Equity/JengaPay, KCB) and non-bank gateways (Pesapal, DPO Group, Cellulant Tingg, Flutterwave, Paystack), carrying the bank/non-bank distinction directly into the acquiring layer. Acceptance is dominated by Lipa na M-Pesa till and paybill, supplemented by card and QR. Scheme high-risk programmes — Visa BRAM and Mastercard QMAP — require acquirers to manage or terminate offending merchants. Fraud risk is concentrated in mobile-money social engineering and SIM-swap rather than classic card-present fraud.

The commercial significance is that a hybrid card-plus-mobile acquiring stack with BRAM/QMAP exposure shapes onboarding economics and chargeback liability for Kenyan acquirers. This sits at Monitored impact and Assessed confidence, reflecting T3-only sourcing on the acquiring market structure.

Outlook

The W8 trajectory is stable. Risk-framework pressure links forward to the W4 scheme-compliance tightening (VAMP thresholds), which feeds chargeback and fraud-ratio management at the acquirer level.

Product Innovation & Market Development

Two product-access developments stand out. On 22 December 2025 the Capital Markets Authority granted Safaricom and Airtel Money Kenya licences to operate as Intermediary Service Platform Providers (ISPPs), connecting mobile-money users to regulated capital-markets products via apps, USSD and agent networks — expanding access to investments, savings and insurance. This turns telco wallets into capital-markets distribution channels, widening the addressable product set for mobile-money incumbents.

As a dashboard-tier dated item, Safaricom launched Daraja 3.0 in November 2025, now cloud-native with improved reliability, faster onboarding and new security APIs, addressing long-standing developer criticism of M-Pesa's closed, bureaucratic integration model relative to India's UPI. The underlying Fintech 2.0 modular platform enables faster integrations and AI-guided fraud detection. A modernised Daraja API lowers integration friction for fintechs building on M-Pesa, partially answering the openness criticism. Both developments concern the non-bank mobile-money segment.

Outlook

The W9 trajectory is established. Product-access developments here interact with the structural opening dynamics tracked in W5 (FPS) and W6 (market concentration); the ISPP and Daraja moves widen distribution and integration without yet displacing the closed-ecosystem structure.