Updated 1 November 2026
Digital lenders in Kenya work under strict rules: the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 (Legal Notice No. 46) ban them from calling your contacts, shaming you online, listing you on a credit bureau for small debts and charging interest without limit once a loan goes bad. Many borrowers never read these rules, and some apps count on that. Here are ten things a licensed loan app is not allowed to do, each with the regulation behind it.
Updated November 2026. Source: CBK (Digital Credit Providers) Regulations, 2022, Kenya Gazette Supplement No. 45 of 18 March 2022, published on centralbank.go.ke.
The 10 rules digital lenders in Kenya must follow
1. Lend to you without a CBK licence
Regulation 4 says no one may carry out, or advertise, digital credit business in Kenya without a CBK licence. CBK publishes the licensed names; check any app against our list of CBK licensed digital lenders before you borrow.
2. Take deposits or cash “security”
Under regulation 8(2), a digital lender cannot invite or collect deposits in any form, including cash collateral as security for a loan. An app that asks you to “pay a refundable fee to unlock your limit” is breaking this rule, and it is a classic scam pattern.
3. Threaten you, your reputation or your property
Regulation 20(a) bans the use of threats, violence or any other means to harm a borrower, their reputation or property for not paying.
4. Send insults to you or your contacts
Regulation 20(b) bans obscene or profane language sent to you or to your references or contacts to shame you.
5. Raid your phone book and message your contacts
Regulation 20(c) bans accessing your phone book, contacts or call records to message people when you pay late, and 20(e) bans unauthorised or unsolicited calls and messages to your contacts. This was the single most common complaint against loan apps before the regulations took effect.
6. Post your details online to shame you
Regulation 20(d) bans posting your personal or sensitive information online or on any other forum to shame you. A catch-all in 20(f) and (g) also bans any improper or unconscionable collection tactic and any conduct that harasses, oppresses or abuses anyone over a debt.
7. Share your data without your consent
Regulation 13(2) says a digital lender cannot share customer information with anyone else without your consent, unless a law requires or permits it. Staff and agents must keep your information confidential even after they leave.
8. List you on CRB for KSh 1,000 or less, or without notice
Regulation 14(3) bars a digital lender from sending negative information to a credit reference bureau where the amount outstanding is KSh 1,000 or less. For larger amounts, regulation 14(5) requires written or electronic notice at least 30 days before listing, or a shorter period set in your contract that can never be under seven days.
9. Charge interest forever on a loan that has gone bad
Regulation 19 caps what a lender can recover on a non-performing loan at: the principal owed when the loan went bad, plus contract interest of no more than that principal, plus reasonable recovery expenses. In plain terms, on a KSh 5,000 defaulted balance, interest cannot pile up beyond another KSh 5,000. (A court order can add further interest.)
10. Change prices or terms behind your back
A lender needs CBK’s written approval to change its pricing model (regulation 29(1)) or launch or change a loan product (regulation 17). It must give you at least 30 days’ notice before raising charges or limits or varying your terms (regulations 27(5) and 29(2)). Before lending, it must also give you the full terms, including the total cost of credit and the annual percentage rate (regulation 27).
A bonus rule: they must check you can repay
Regulation 18 says a digital lender cannot advance credit before taking reasonable steps to assess your ability to repay. Pushing ever-bigger limits on a borrower who is clearly struggling sits badly with this rule.
What to do if a digital lender breaks these rules
- Screenshot every threatening message, call log and post, with dates.
- Complain to the lender in writing first and keep the reference.
- Report the lender to the Central Bank of Kenya, which licenses and supervises digital credit providers and can impose penalties.
- For misuse of your personal data or contacts, you can also complain to the Office of the Data Protection Commissioner.
Compare what apps really cost on the loan app cost checker, and read individual reviews such as Tala and Zenka, which list each app’s licence status.
Frequently asked questions
Can a loan app call my contacts in Kenya?
No. Regulation 20 of the CBK Digital Credit Providers Regulations, 2022 bans accessing your phone book to message contacts and making unsolicited calls or messages to your contacts during debt collection.
Can a digital lender list me on CRB for a small loan?
Not if the outstanding amount is KSh 1,000 or less. For larger debts, the lender must give you at least 30 days’ notice (or a contractual period of at least seven days) before listing.
Is there a limit to interest on a defaulted loan app loan?
Yes. On a non-performing loan, the lender can recover the principal, plus interest not exceeding that principal, plus reasonable recovery costs, unless a court orders more.
Do these rules apply to banks and Saccos?
No. The regulations exclude banks, microfinance banks and Saccos, which are covered by their own laws. They apply to non-deposit-taking digital credit providers.
Prefer WhatsApp? Follow Business Radar on WhatsApp
Weekly, free. We only use your email for this newsletter and you can unsubscribe in one click. Privacy policy.
