Kenya

Currency: KES
Services available: 102
Obligations tracked: 5

Regulatory landscape

Kenya licenses payment activity under the National Payment Systems Act and its regulations, administered by the Central Bank of Kenya. Payment Service Provider, Money Remittance Provider and Digital Credit Provider are the categories most fintechs need.;

Digital lending was brought under direct CBK supervision by the Central Bank of Kenya (Digital Credit Providers) Regulations, which impose licensing, pricing disclosure and debt-collection conduct requirements.;

Anti-money-laundering obligations derive from the Proceeds of Crime and Anti-Money Laundering Act. Data protection is governed by the Data Protection Act 2019, with controller and processor registration handled by the Office of the Data Protection Commissioner.

Regulators

CBK
ODPC
CMA
IRA

Recurring obligations

What a licensed entity in Kenya has to do, and how often. Which of these apply to you depends on your entity type and the licences you hold. In the portal, the applicable ones attach to your organisation automatically and appear on a calendar with reminders.

CBK

Obligation	Frequency	When	Service
Digital Credit Provider periodic returns Submit the periodic returns required of licensed digital credit providers.	Quarterly	As specified in the Digital Credit Providers Regulations	View
Payment service provider annual audit Submit audited financial statements and any required system audit for the payment service provider licence.	Annual	Within the period specified following the financial year end	View

Financial Reporting Centre

Obligation	Frequency	When	Service
Suspicious transaction reporting Report suspicious transactions to the Financial Reporting Centre under POCAMLA.	On event	Within the statutory period after forming a suspicion	View

ODPC

Obligation	Frequency	When	Service
Data controller or processor registration renewal Maintain registration as a data controller or processor with the Office of the Data Protection Commissioner.	Annual	Renewed annually before expiry of the certificate	View
Personal data breach notification Notify the Data Commissioner of a personal data breach within the statutory window.	On event	Within 72 hours of becoming aware of the breach	View

Engagements available in Kenya

Service	Practice area
AML/CFT Gap Assessment and Remediation Roadmap	AML, CFT and Financial Crime
AML/CFT Training Curriculum and Materials	AML, CFT and Financial Crime
AML/CFT/CPF Policy and Procedures Manual	AML, CFT and Financial Crime
Board and Senior Management AML Briefing Pack	AML, CFT and Financial Crime
Crypto Travel Rule Compliance Framework	AML, CFT and Financial Crime
Enterprise-Wide ML/TF/PF Risk Assessment	AML, CFT and Financial Crime
KYB and Beneficial Ownership Framework	AML, CFT and Financial Crime
KYC/CDD/EDD Programme and Customer Risk Rating Model	AML, CFT and Financial Crime
Sanctions and PEP Screening Programme Design	AML, CFT and Financial Crime
STR/SAR Filing Playbook and goAML Guide	AML, CFT and Financial Crime
Transaction Monitoring Model Validation	AML, CFT and Financial Crime
Transaction Monitoring Rules Design and Tuning	AML, CFT and Financial Crime
Wolfsberg CBDDQ Completion Pack	AML, CFT and Financial Crime
AML Alert Backlog and Look-Back Review	AML, CFT and Financial Crime
Independent AML/CFT Audit	AML, CFT and Financial Crime
Full Compliance Function	AML, CFT and Financial Crime
Outsourced Money Laundering Reporting Officer	AML, CFT and Financial Crime
CBK Digital Credit Provider Licence Application Support	Licensing support and regulatory affairs
CBK Money Remittance Provider Licence Application Support	Licensing support and regulatory affairs
CBK Payment Service Provider Licence Application Support	Licensing support and regulatory affairs
Change in Control and Shareholding Approval	Licensing support and regulatory affairs
Fit and Proper Pack	Licensing support and regulatory affairs
Licence Maintenance and Returns Filing	Licensing support and regulatory affairs
Mock Regulatory Examination	Licensing support and regulatory affairs
Multi-Market Entry and Regulatory Feasibility Study	Licensing support and regulatory affairs
Regulatory Examination Remediation Programme	Licensing support and regulatory affairs
Regulatory Sandbox Application	Licensing support and regulatory affairs
Compliance Calendar and Returns Filing Service	Licensing support and regulatory affairs
Regulatory Change Monitoring	Licensing support and regulatory affairs
Business Continuity and Disaster Recovery Plan	Cybersecurity and Assurance
CBN Risk-Based Cybersecurity Framework Assessment	Cybersecurity and Assurance
Incident Response Plan and Playbooks	Cybersecurity and Assurance
Information Security Policy Suite	Cybersecurity and Assurance
ISO 27001 Internal Audit	Cybersecurity and Assurance
ISO 27001 ISMS Documentation Suite	Cybersecurity and Assurance
PCI DSS v4.x Gap Assessment and Scoping	Cybersecurity and Assurance
Secure SDLC Programme Design	Cybersecurity and Assurance
SOC 2 Readiness Assessment	Cybersecurity and Assurance
Third-Party Security Assessment	Cybersecurity and Assurance
API Penetration Test	Cybersecurity and Assurance
Cloud Configuration and Security Review	Cybersecurity and Assurance
Dependency and Container Security Assessment	Cybersecurity and Assurance
External Network Penetration Test	Cybersecurity and Assurance
Internal Network Penetration Test	Cybersecurity and Assurance
Mobile Application Penetration Test	Cybersecurity and Assurance
PCI ASV External Scanning	Cybersecurity and Assurance
Phishing Simulation Campaign	Cybersecurity and Assurance
Platform Configuration Review	Cybersecurity and Assurance
Remediation Validation Retest	Cybersecurity and Assurance
Secure Source Code Review	Cybersecurity and Assurance
Web Application Penetration Test	Cybersecurity and Assurance
Wireless Security Assessment	Cybersecurity and Assurance
Card Scheme and EMV Certification Support	Cybersecurity and Assurance
ISO 27001 Full Implementation to Certification	Cybersecurity and Assurance
PCI DSS Report on Compliance	Cybersecurity and Assurance
Red Team and Adversary Simulation	Cybersecurity and Assurance
SOC 2 Type I Audit	Cybersecurity and Assurance
SOC 2 Type II Audit	Cybersecurity and Assurance
Continuous Attack Surface Monitoring	Cybersecurity and Assurance
Incident Response Retainer	Cybersecurity and Assurance
Virtual Chief Information Security Officer	Cybersecurity and Assurance
Vulnerability Management as a Service	Cybersecurity and Assurance
Breach Response Playbook and Notification Templates	Data Protection and Privacy
Cross-Border Transfer Impact Assessment	Data Protection and Privacy
Data Protection Impact Assessment	Data Protection and Privacy
DSAR Handling Process and Templates	Data Protection and Privacy
Kenya DPA Readiness and ODPC Registration Pack	Data Protection and Privacy
NDPA/NDPR Compliance Gap Assessment	Data Protection and Privacy
Privacy Notice and Consent Framework Suite	Data Protection and Privacy
ROPA, Data Mapping and Retention Schedule	Data Protection and Privacy
Outsourced Data Protection Officer	Data Protection and Privacy
Capital Adequacy and Prudential Ratio Review	Financial Audit and Tax
IFRS 9 ECL Model Documentation and Validation	Financial Audit and Tax
Internal Audit Plan and Risk-Based Audit Universe	Financial Audit and Tax
Investor Compliance Due Diligence Pack	Financial Audit and Tax
Safeguarding and Trust Account Reconciliation Review	Financial Audit and Tax
Tax Health Check and Compliance Review	Financial Audit and Tax
Transfer Pricing Documentation	Financial Audit and Tax
Forensic Investigation and Fraud Examination	Financial Audit and Tax
IFRS 17 Implementation	Financial Audit and Tax
Internal Audit Outsourcing	Financial Audit and Tax
Statutory External Audit	Financial Audit and Tax
AI/ML Model Risk Validation	Risk and Governance
Anti-Bribery and Corruption Programme	Risk and Governance
Consumer Protection and Complaints Framework	Risk and Governance
Corporate Governance Framework and Board Charters	Risk and Governance
Credit Scoring Model Validation and Bias Audit	Risk and Governance
Digital Lending Compliance Assessment	Risk and Governance
ERM Framework, Risk Register and KRI Library	Risk and Governance
ESG and IFRS S1/S2 Reporting Readiness	Risk and Governance
Financial Promotions and Marketing Compliance Review	Risk and Governance
Fraud Risk Management Framework	Risk and Governance
Internal Control Framework Design	Risk and Governance
Operational Resilience and Critical Service Mapping	Risk and Governance
Outsourcing and Third-Party Risk Framework	Risk and Governance
Board and Executive Briefing	Risk and Governance
Certification Exam Preparation	Risk and Governance
Open-Enrolment Course Seat	Risk and Governance
Outsourced Compliance Officer	Risk and Governance
Policy Library Subscription	Risk and Governance
Private Cohort Training	Risk and Governance
Security and Compliance Training Programme	Risk and Governance