title: Kenya Payments Regulation Monitor | World Payments Monitor canonical: https://payments.gi/jurisdictions/kenya/ date_modified: 2026-10-21 publisher: Asymmetric Intelligence # Kenya KE schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-21 · 14 modules · 58 sourced findings · 126 sources in the cumulative register 14 Modules baseline.modules[] 58 Findings modules[].findings[] 14 Tier-1 sources run_metadata.t1_source_count Confidence mix (sums to 14 rendered modules; click to filter) ## Jurisdiction brief ###### Latest update · 18 October 2026 #### Lead Signal Kenya's Treasury and Central Bank published the draft National Payment System Bill, 2026 for consultation on 21 September 2026, with the comment period closing 9 October 2026. The draft would repeal the current Cap. 491A regime and replace it with ten payment-service-provider and payment-system-operator licence categories carrying tiered capital requirements from KES5 million up to KES250 million, alongside a material expansion of Central Bank of Kenya supervisory powers: unannounced inspection authority, consolidated group supervision, officer-removal powers, business-restriction orders and the ability to appoint a statutory manager. The Bill has not yet been approved by Cabinet or tabled in Parliament, so these remain proposed rather than enacted powers. #### Other Developments **Virtual asset service providers offering payment-related services** would, under the draft Bill, be brought within the payments licensing perimeter for the first time, extending Central Bank of Kenya oversight to a category of firm not previously captured by payments-specific licensing. **The stablecoin regime under the Virtual Asset Service Providers Regulations, 2026**, already in force since 22 July 2026, requires full reserve backing of stablecoin issuance at or above nominal value, segregation of reserve pools from issuer operating assets and from other stablecoins' reserves, par redemption within two working days of a holder request, and a prohibition on issuers paying interest to holders. This is a comprehensive, CBK-anchored stablecoin framework operating independently of the draft National Payment System Bill, 2026's broader PSP licensing overhaul. **Consumer digital-payments activity** shows continued momentum: data cited as a proxy for the sector recorded a 29.5% quarter-on-quarter rise in Kenya's iGaming demand through the third quarter of 2026, indicating sustained growth in digitally-mediated consumer transaction volumes even as the regulatory perimeter around payments is being redrawn. #### Cross-Monitor Connections The draft Bill's extension of CBK licensing to virtual-asset payment activity connects directly to Kenya's broader digital-asset regulatory build-out represented by the Virtual Asset Service Providers Regulations, 2026, which already established a parallel CBK/CMA licensing track for virtual-asset activity generally. The expansion of CBK's enforcement toolkit, including statutory-manager appointment and business-restriction powers, is a structural development relevant to financial-integrity monitoring of supervisory capacity in Kenya's payments sector. #### Outlook The consultation on the draft National Payment System Bill, 2026 closed 9 October 2026; the next milestone to watch is whether the Bill is approved by Cabinet and tabled in Parliament, and whether the ten-category licence structure, tiered capital requirements, and expanded CBK powers survive that process intact. Separately, the stablecoin regime's practical operation will be tested as issuers already licensed under the VASP Regulations continue operating under the reserve-backing and redemption requirements now in force. _4 earlier updates not shown here._ ###### Standing brief · as of 24 June 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Lead Signal Kenya's payments operating environment now turns on a single, sharply defined gap: a digital-money statute that is in force against implementing rules that are not. The Virtual Asset Service Providers (VASP) Act 2025 was assented in October 2025 and came into force on 4 November 2025, establishing a dual-regulator model in which the Central Bank of Kenya licenses payment-related virtual assets — stablecoin dealers, virtual asset wallet providers, payment processors and stablecoin-issuance providers — while the Capital Markets Authority supervises exchanges, brokers and tokenisation platforms. The operationalising regulations, however, remain in draft. The draft National Treasury rules would set the heaviest capital requirement on stablecoin issuers at KES 500 million (~USD 3.8m), counting only fully paid-up funds, with licensing fees ranging from KES 100,000 to KES 2 million. Consultation on those rules closed on 10 April 2026, but gazette had not been confirmed as of 24 June 2026, and no VASP had been licensed. The framework exists; operational certainty does not. We assess this split — in-force Act, pending subsidiary rules — as the defining commercial-certainty gap for any issuer planning Kenya entry, and we hold confidence at Assessed rather than High precisely because the licensing mechanics are unresolved. This foundational uncertainty sits atop an otherwise mature licensing architecture. The CBK operates a single-tier non-bank PSP authorisation regime under the National Payment System Act 2011 and NPS Regulations 2014, with four PSP categories and First Schedule core-capital floors of KES 5,000,000, KES 50,000,000, KES 20,000,000 and KES 1,000,000 across the category tiers. There is no EMI or PI passporting, foreign licences are not recognised, and each applicant must be locally incorporated and CBK-authorised, with full authorisation typically taking four to nine months. Banks are licensed separately under the Banking Act (Cap 488). The binding constraint on market access is therefore local incorporation plus non-recognition of foreign licences — not the capital floors themselves. #### Other Developments The cross-border picture shifted materially in early 2026. Announced 26 February 2026, Pesalink became a PAPSS Technical Connectivity Provider, connecting 80+ Kenyan bank, fintech, SACCO and telco participants to 160+ commercial banks and fintechs on PAPSS and enabling instant 24/7 cross-border payments settled in local currencies, with Kenya the 10th African central bank on the system. This directly addresses correspondent-banking de-risking pressure, which is amplified by Kenya's FATF grey-listing (placed February 2024, retained through the June 2026 plenary) and its EU high-risk third-country listing (added 10 June 2025). On the domestic rails side, the CBK's Fast Payment System national switch — originally targeted for 2025 — remains unconfirmed as launched, with industry sources suggesting a build of up to four years. In consumer protection, the CBK has unveiled a plan under the Kenya National Financial Inclusion Strategy 2025-2028 to establish formal compensation rules for e-money and digital-wallet fraud, committed for implementation by end-2026; this is a pending regime, not a UK-PSR-style mandatory reimbursement scheme in force. The in-force Digital Credit Providers Regulations 2022, strengthened by the Business Laws (Amendment) Act 2024/2025 with its harassment ban and in-duplum interest cap, continue to reshape the digital-lending segment. On the commercial side, a bank-into-fintech vertical-integration pattern is emerging: KCB Group acquired a 75% controlling stake in Riverbank Solutions in March 2025 for about KES 2 billion (~USD 15.4m), and on 31 October 2025 announced an undisclosed minority stake in CBK-licensed PSP Pesapal, still awaiting regulatory approval as of an 11 March 2026 investor briefing. #### Cross-Monitor Connections Kenya's AML/CFT status is carried here from the Sentinel feed only; original illicit-finance and grey-list-exit analysis is routed to FIM. The FATF grey-list retention (June 2026), EU high-risk listing (June 2025) and the AML and Combating of Terrorism Financing Laws (Amendment) Act 2025 signed on 17 June 2025 carry illicit-finance and sanctions-evasion significance beyond the WPM payments-context carry. Likewise, the VASP Act bringing virtual-asset flows into a supervised perimeter has illicit-finance-use significance — travel rule, VASP as reporting institution — that is a FIM flag, not a WPM conclusion. Within WPM, the grey-list-driven correspondent-banking de-risking is best read narrowly as a settlement and access friction, with PAPSS local-currency settlement as the direct commercial mitigation. #### Outlook The near-term watch items are concentrated and datable. First, finalisation and gazette of the VASP Regulations 2026, expected in the second half of 2026, will close the in-force-Act-versus-pending-rules gap and is the single most important forward signal for stablecoin and virtual-asset payment operators. Second, the CBK Fast Payment System launch remains the structural lever against M-Pesa's near-monopoly mobile-money position (~89.7% share, transaction activity equivalent to ~8% of GDP); timeline slippage preserves the incumbent's standing. Third, the CBK e-money fraud-compensation framework, targeted for end-2026, would shift liability onto mobile-money providers if implemented. Fourth, CBK approval of the KCB-Pesapal minority stake will confirm whether the bank-into-fintech integration pattern consolidates. Each of these is pending and worth diffing on the next periodic run. trust tier: ai_unverified ###### Latest update · 18 October 2026 #### Regulatory Status Kenya's payments regulatory environment is in active transition. The draft National Payment System Bill, 2026, published for consultation 21 September 2026 with comments closing 9 October 2026, would repeal the existing Cap. 491A framework and introduce ten PSP/PSO licence categories with tiered capital requirements from KES5 million to KES250 million, alongside materially expanded Central Bank of Kenya supervisory powers including unannounced inspection, consolidated group supervision, officer removal, business restriction and statutory-manager appointment. None of this is yet in force. Running in parallel, and already operative since 22 July 2026, the Virtual Asset Service Providers Regulations, 2026 establish a CBK-licensed stablecoin regime requiring full reserve backing, asset segregation, par redemption within two working days, and a ban on interest payments to holders. The draft Payment System Bill would further extend CBK's payments perimeter to cover virtual asset service providers offering payment-related services, layering a second licensing track on top of the existing VASP regime for that subset of activity. #### Outlook The consultation on the draft Bill closed 9 October 2026; Cabinet approval and parliamentary tabling are the next steps to watch. The stablecoin regime continues operating under its reserve and redemption requirements independent of the Bill's progress. _4 earlier updates not shown here._ ###### Standing brief · as of 24 June 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Regulatory Status Kenya presents as a mature, mobile-money-led payments jurisdiction with a clear bank/non-bank regulatory split and an elevated, escalating jurisdiction risk profile. Market access (W1a) runs through a single-tier CBK non-bank PSP regime under the NPS Act 2011 and NPS Regulations 2014, with four category-tiered capital floors (KES 5m / 50m / 20m / 1m), no passporting, non-recognition of foreign licences and mandatory local incorporation; banks are licensed separately under the Banking Act (Cap 488). Conduct and safeguarding (W1b) rest on a mandatory bank-trust model for customer/e-money funds, with product-name approval (Reg 7) and agent AML compliance (Reg 17). The defining live development is digital money (W2): the VASP Act 2025 entered force on 4 November 2025 with a dual CBK/CMA regulator model, but the implementing VASP Regulations 2026 — including a proposed ~KES 500m stablecoin-issuer capital floor — remained in draft and unconfirmed as gazetted as of 24 June 2026, with no VASP yet licensed (confidence Assessed). Operational resilience (W3) is anchored in the CBK 2019 PSP Cybersecurity Guideline with no DORA-equivalent statute, against the backdrop of M-Pesa's September 2025 Fintech 2.0 core migration. Scheme compliance (W4) flows down via Visa VAMP and Mastercard SDP with no domestic interchange cap. Cross-border and settlement (W5, W12) are reshaped by Pesalink's 26 February 2026 PAPSS integration enabling local-currency settlement, set against correspondent-banking de-risking pressure driven by Kenya's FATF grey-list status (retained June 2026) and EU high-risk listing (June 2025) — carried via the Sentinel feed in W11 with original analysis routed to FIM. Market structure (W6) is a near-monopoly mobile-money ecosystem (M-Pesa ~89.7%, ~8% of GDP). Legal/litigation (W7) features the 2022 PSP-scope ruling and ODPC digital-lending enforcement; consumer protection (W10) combines an in-force DCP regime with harassment criminalisation and a pending e-money fraud-compensation framework. Product development (W9) includes CMA ISPP licences (December 2025) and Daraja 3.0. Commercial intelligence (W13) is led by KCB's bank-into-fintech integration (Riverbank completed; Pesapal pending CBK approval). #### Outlook Kenya's jurisdiction risk is elevated and escalating: FATF grey-list retention plus EU high-risk listing drive correspondent-banking de-risking, partially offset by AML Amendment Act 2025 remediation and PAPSS integration. The principal near-term watch items are the VASP Regulations 2026 gazette (2026-H2), the CBK Fast Payment System launch (timeline uncertain, multi-year band), the e-money fraud-compensation framework (targeted end-2026), and CBK approval of the KCB-Pesapal deal (2026). Several of these are pending instruments to diff against the first periodic run. 14 of 14 modules Signal Density Selections OR within a group, AND across groups. Press / to search. ### W1a Licensing, Authorisation & Market Access moved Confirmed confirmed 2026-06-24 CBK and National Treasury published the Draft National Payment System Bill, 2026 and accompanying Draft National Payment System Policy on 21-22 September 2026 for public participation (comments due 9 October 2026). The Bill would repeal the National Payment System Act, 2011 (Cap. 491A) and introduce new licence categories including payment initiation service providers, account information service providers, merchant acquirers, electronic wallet providers, electronic money issuers, payment gateways and payment messaging operators, and brings VASPs offering payment services within the payments perimeter. Existing payment companies would get one year from the Act's effective date to comply with new requirements including capital thresholds and trust-account rules. Movement — CHANGED Draft National Payment System Bill, 2026 published for consultation, closed 9 October 2026_New draft legislative instrument proposing comprehensive payments-licensing overhaul._ Standing sub-brief · as of 24 June 2026 313 words · last cycle 2026-10-18 #### Licensing, Authorisation & Market Access Kenya runs a mature, single-tier non-bank PSP authorisation regime administered by the Central Bank of Kenya under the National Payment System Act 2011 and the NPS Regulations 2014. The framework defines four PSP categories — Electronic Retail Payment Service Provider, Designated Payment Instrument Issuer, E-Money Issuer, and Small E-Money Issuer. Section 12 of the NPS Act prohibits the conduct of PSP business without CBK authorisation. Critically for non-bank payment institutions and e-money issuers, there is no EMI or PI passporting, and the CBK does not recognise other central banks' licences: each applicant must be locally incorporated and separately CBK-authorised. Banks, by contrast, are licensed under the Banking Act (Cap 488), a distinct prudential track from the non-bank PI/EMI regime described here. The First Schedule sets category-tiered core-capital thresholds: KES 5,000,000 for an electronic retail PSP, KES 50,000,000 for a designated payment instrument issuer, KES 20,000,000 for an e-money issuer, and KES 1,000,000 for a small e-money issuer. The full authorisation process typically runs four to nine months. Unlicensed PSP operation is illegal, and enforcement against unlicensed operators has been intensifying since 2023. The analytical takeaway is that the binding market-access constraint is structural, not financial. The capital floors and four-to-nine-month timeline are a direct cost-of-entry signal for fintech operators, but the determinative barriers are the mandatory local-incorporation requirement and the non-recognition of foreign licences, which together bar any licence portability into the Kenyan market. Any non-bank payments operator entering Kenya must therefore build a locally incorporated, CBK-authorised entity from the ground up. #### Outlook The W1a baseline is Confirmed and trajectory established; the regime is mature and stable. Forward watch items concentrate in adjacent modules — the in-force VASP Act licensing categories (W2) and any national-switch licensing implications (W5) — rather than in the core NPS Act framework itself, which is not expected to shift in the near term. Periodic update · new data 2026-10-18 #### Licensing, Authorisation & Market Access Kenya's draft National Payment System Bill, 2026 was published for public consultation on 21 September 2026, with the comment window closing 9 October 2026. The draft proposes to repeal the current Cap. 491A payments framework and replace it with ten distinct payment-service-provider and payment-system-operator licence categories, each carrying its own tiered capital requirement ranging from KES5 million at the lower end to KES250 million for the largest category. Alongside the new licence structure, the draft Bill would materially expand the Central Bank of Kenya's supervisory toolkit: powers proposed include unannounced on-site inspection, consolidated group-level supervision of corporate structures spanning multiple licensed entities, the power to order removal of a firm's officers, authority to restrict a licensed firm's business activities, and the ability to appoint a statutory manager to take control of a troubled institution. None of these powers are currently in force; the Bill remains at the consultation stage, has not been approved by Cabinet, and has not been tabled before Parliament. A further provision of the draft Bill would bring virtual asset service providers offering payment-related services within the payments licensing perimeter for the first time, layering payments-specific licensing on top of the separate CBK/CMA virtual-asset licensing regime already established under the Virtual Asset Service Providers Regulations, 2026. This would mean a VASP offering payment-adjacent services in Kenya could, if the Bill proceeds unamended, face obligations under both regimes. #### Outlook The consultation period closed 9 October 2026. The next material event is Cabinet approval and parliamentary tabling; the scope of CBK's expanded powers and the final capital-tier structure both remain subject to change before enactment. **4 earlier distinct update(s)** Periodic update · new data 2026-10-11 #### Licensing, Authorisation & Market Access The Draft National Payment System Bill, 2026 was jointly published by the National Treasury and the Central Bank of Kenya on 21-22 September 2026, proposing to repeal the National Payment System Act, 2011 (Cap. 491A) in its entirety and replace it with a new licensing taxonomy. The proposed licence categories include payment initiation service providers, account information service providers, merchant acquirers, electronic wallet providers, electronic money issuers, payment gateways, and payment messaging operators. Notably, the draft Bill brings virtual asset service providers that offer payment services within the payments perimeter for the first time, creating an overlap with the VASP Act, 2025 licensing regime administered separately by the Central Bank of Kenya and the Capital Markets Authority. Public comment on the draft closed on 9 October 2026, following a consultation process that included eleven county-level public forums, reflecting a deliberately broad public-participation exercise ahead of any parliamentary introduction. A separate compliance-transition provision proposed in the draft would give existing payment companies one year from the Act's eventual effective date to comply with new requirements, including new capital thresholds and trust-account rules. Because the Bill remains in draft form following the close of public comment, neither its effective date nor the resulting one-year transition deadline is yet fixed; the proposal establishes the mechanism but not yet the calendar. The scale of this proposed overhaul is significant: it is the first comprehensive replacement of Kenya's payment-system licensing architecture in over a decade, and its new taxonomy would apply to both bank and non-bank payment service providers, without differentiating licensing requirements materially between the two categories on the evidence available this cycle. #### Outlook The Bill's movement from public-comment closure toward a parliamentary process is the development to track next. The one-year compliance transition window, when it is eventually anchored to a fixed effective date, will be the key operational deadline for existing Kenyan payment companies to track against new capital and trust-account requirements. Until the Bill is enacted, the current National Payment System Act, 2011 framework remains the binding law. Periodic update · new data 2026-09-28 #### Licensing, Authorisation & Market Access Kenya's Treasury and Central Bank of Kenya published a draft National Payment System Bill, 2026 for public comment on 22 September 2026, intended to replace the National Payment System Act 2011. The draft Bill requires any person providing a payment service or operating a payment system to hold a CBK licence. This provision is significant not because licensing itself is new to Kenya's payments market, but because it codifies into primary statute the outcome of the 2022 KENEX v CBK High Court ruling, closing a gap between judicial interpretation and the underlying legislative text that has existed since that ruling. Alongside the licensing requirement itself, the draft Bill sets minimum capital requirements that vary by payment-service-provider category, ranging from KSh 5 million at the lower end to KSh 250 million at the top end. The KSh 250 million threshold applies specifically to electronic money issuers, marking out that category as facing the highest capital bar under the proposed framework. This tiered structure draws an explicit distinction between categories of payment-service provider, with capital intensity scaling according to the nature and scale of the licensed activity. The reform is broad in scope: it touches licensing, safeguarding, resilience and open finance in a single draft instrument, which the underlying source material characterises as the most significant proposed overhaul of Kenya's payments regulatory perimeter since the 2011 Act. The draft Bill has not yet been through formal legislative process; the public comment period on the draft Bill and its companion Policy runs to 9 October 2026. #### Outlook The key date is 9 October 2026, when the public comment period closes. Whether the licensing perimeter and the tiered capital requirements survive the comment process intact, or are revised, will determine the shape of market access for both bank and non-bank payment-service providers going into any subsequent legislative stage. Periodic update · new data 2026-09-21 #### Licensing, Authorisation & Market Access Kenya's payments market-access regime moved decisively this cycle following High Court confirmation that the Central Bank of Kenya's regulatory jurisdiction under the National Payment System Act, 2011 extends broadly, covering any person engaged in any process in a payment system. This resolves what had been an open interpretive question in CBK's favour, in the KENEX v CBK line of authority, and it forecloses arguments that narrower payment-adjacent activities might sit outside CBK's licensing perimeter. The practical effect is that a wider range of business models touching payment processes in Kenya should now expect to be treated as within CBK's regulatory reach, rather than assuming an activity is unregulated by default. Alongside this judicial confirmation, market-access terms for non-resident fintechs remain structurally closed to cross-border licence portability: any non-resident entity wishing to provide payment services in Kenya must incorporate locally and obtain a standalone CBK licence, with no mutual recognition extended to payment-service licences issued by other African central banks. This means a PSP licensed in, for example, a neighbouring East African jurisdiction gains no fast-track or passporting benefit when entering the Kenyan market; it must build local corporate and licensing infrastructure from the ground up, on the same basis as a licensee with no prior African regulatory history. This is a probable-confidence finding sourced from advisory-firm commentary rather than direct primary-instrument text, but it is consistent with the structurally national character of NPS Act licensing. CBK's own primary-source Directory of Authorized Payment Service Providers, current as at 15 May 2026, provides a confirmed, T1-sourced picture of who currently sits within the authorised perimeter: Safaricom (M-Pesa), Airtel Money Kenya, and Cellulant Kenya are named among the authorised providers. This register is a genuine primary-source confirmation point distinct from secondary commentary about market participants, and it should be treated as the authoritative current-state reference for who is licensed, pending any further updates. Taken together, this cycle's W1a picture is one of judicially-reinforced regulatory breadth combined with continued market-access friction for non-resident entrants: the perimeter is wide, the licensing bar for foreign entrants is high and non-portable, and the confirmed-authorised-provider list remains concentrated among a small number of dominant, already-established players. #### Outlook The question worth tracking into the next cycle is whether the confirmed breadth of CBK's PSP jurisdiction produces visible enforcement activity against previously-unlicensed entities now clearly within scope, or whether it functions primarily as a deterrent against future ambiguous-status market entry. Separately, watch for any regional or bilateral discussion of mutual recognition arrangements for payment licences among African central banks, since the current absence of such recognition is a structural, not incidental, feature of Kenya's regime as it stands. Periodic update · new data 2026-09-05 #### Licensing, Authorisation & Market Access Kenya's payment service provider licensing regime, administered by the Central Bank of Kenya under the National Payment System Act 2011 and the National Payment System Regulations 2014, is structured around four categories defined by transaction type and volume rather than a single generic payment-services licence: Electronic Retail PSP, Designated Payment Instrument Issuer, E-Money Issuer, and Small E-Money Issuer. This category-based design means an applicant's obligations, capital expectations and conduct requirements are calibrated to the specific licence category it falls into, rather than a uniform standard applied across all payment providers. The most material market-access finding this cycle concerns non-resident fintechs. Any non-resident firm seeking to serve Kenyan customers must obtain CBK licensing regardless of whether it maintains a physical presence in Kenya, and must additionally establish a local registered office and appoint a resident compliance officer or agent. CBK does not recognise foreign-issued payment licences as a substitute for local authorisation. This bears with particular weight on the non-bank PI/EMI segment: a bank-affiliated PSP typically already carries a banking charter and local presence, whereas a pure non-bank fintech seeking Kenya-facing distribution faces the local-incorporation and resident-officer requirement as the binding constraint on market entry, with no lighter-touch cross-border passporting route available. For an operator assessing entry, this licensing structure should be read as a moderate-to-high market-access barrier for non-resident non-bank players specifically, while posing a lower incremental barrier for firms that already hold, or can obtain, a Kenyan banking licence. #### Outlook Whether CBK moves toward any form of streamlined or passported authorisation for non-resident PSPs already licensed in comparable regimes is not indicated by this cycle's evidence; the current posture is one of full local licensing with no recognised foreign-licence equivalence. Continued growth in Kenya's digital-payments market may increase pressure for a more efficient non-resident onboarding pathway, but no such reform is signalled this cycle. **Sources and findings (5)** 1. T1 CBK — National Payment System Act 2011 (No. 39 of 2011), s.12 PSP authorisation (centralbank.go.ke) 2. T1 National Payment System Regulations 2014 — PSP licensing/fees; core capital KES 5m (centralbank.go.ke) 3. T1 CBK NPSA 2011 / NPSR 2014 — PSP authorisation framework (centralbank.go.ke) 4. T1 CBK NPSA 2011 — authorisation of payment service providers (centralbank.go.ke) 5. T3 [https://www.businessdailyafrica.com/bd/corporate/companies/kcb-to-acquire-minority-stake-in-payment-service-pesapal-5252190 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.businessdailyafrica.com/bd/corporate/companies/kcb-to-acquire-minority-stake-in-payment-service-pesapal-5252190 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) ### W1b Conduct, Safeguarding & Promotions Confirmed confirmed 2026-06-24 Safeguarding of customer/e-money funds in Kenya is achieved through a mandatory trust structure: PSPs must establish a trust with a CBK-licensed bank to hold customer funds, supported by a trust deed required under the NPS Act. Conduct and consumer obligations layer the Consumer Protection Act 2012, Data Protection Act 2019, and POCAMLA. Promotions/product names require CBK approval. The supervising authority is the CBK; banks follow a separate Banking Act conduct track. Standing sub-brief · as of 24 June 2026 226 words · last cycle 2026-09-28 #### Conduct, Safeguarding & Financial Promotions Safeguarding of customer funds in Kenya runs through a mandatory bank-trust model. Non-bank PSPs must establish a trust with a CBK-licensed bank to hold customer and e-money funds, supported by a trust deed required under the NPS Act. This determines where the float sits and the insolvency-remoteness of customer funds for Kenyan e-money issuers. Conduct is layered by the Consumer Protection Act 2012, the Data Protection Act 2019 and POCAMLA, with data-controller registration and a Fit-and-Proper assessment also required of applicants. On promotions and agent conduct, the NPS Regulations 2014 carry two material provisions. Regulation 7 requires CBK approval of any proposed product name before use. Regulation 17 governs the appointment of agents and cash merchants, who must comply with POCAMLA 2009 and the Prevention of Terrorism Act 2012. An e-money holder is defined as a person with a redemption claim on an e-money issuer, and the regime carries an aggregate monthly load-limit framework for e-money. This is the conduct counterpart to the W1a licensing track, and it applies squarely to the non-bank PI/EMI segment rather than to banks. #### Outlook The W1b baseline is Confirmed and established. The principal open question is legal-infrastructure depth: the settlement-finality and insolvency treatment of safeguarded e-money funds held under the bank-trust structure is not fully resolved in available sources and warrants deepening in periodic runs. Periodic update · new data 2026-09-28 #### Conduct, Safeguarding & Financial Promotions The draft National Payment System Bill, 2026, published for public comment on 22 September 2026, introduces a safeguarding requirement for electronic money issuers and digital wallet providers: these firms would be required to hold customer funds in trust accounts insulated from provider insolvency. The mechanism specified is a trust account holding balances equivalent to customer obligations, with those balances protected from attachment in the event of the provider's insolvency. This is a non-bank-specific obligation. It applies to the non-bank payment-institution and e-money-issuer (nonbank_pi_emi) segment of Kenya's market, distinguishing that segment's treatment from bank-operated payment services, which already sit under separate prudential banking regulation and do not face the same insolvency-remoteness question in the same way. The draft provision addresses a structural gap that exists wherever non-bank entities hold customer float without a banking licence: absent a segregation-and-insolvency-remoteness rule, customer funds held by a failing e-money issuer or wallet provider could be exposed to the provider's general creditors. The safeguarding requirement sits within the same draft instrument as the licensing, resolution-power and open-finance provisions addressed elsewhere in this jurisdiction's coverage, and its fate is tied to the same 9 October 2026 public comment deadline and subsequent legislative process. #### Outlook Whether the trust-account safeguarding mechanism, and its specific insolvency-remoteness protection, survives into the Bill's final form will be a key marker for the practical protection available to customers of Kenya's non-bank e-money and wallet providers. This should be tracked alongside the broader legislative timeline running from the 9 October 2026 comment-period close. **Sources and findings (4)** 1. T1 CBK E-Money Regulations 2013 — e-money issuer conduct/safeguarding (centralbank.go.ke) 2. T1 National Payment System Regulations 2014 — customer data/conduct (centralbank.go.ke) 3. T1 [https://new.kenyalaw.org/akn/ke/act/ln/2014/109/eng@2022-12-31](https://new.kenyalaw.org/akn/ke/act/ln/2014/109/eng@2022-12-31) retrieved 2026-06-24 4. T1 [https://www.centralbank.go.ke/images/docs/legislation/NPSRegulations2014.pdf](https://www.centralbank.go.ke/images/docs/legislation/NPSRegulations2014.pdf) retrieved 2026-06-24 ### W2 Stablecoins & Digital Money moved Probable confirmed 2026-06-24 VASP Act 2025 in force 4 Nov 2025; dual-regulator model (CBK payment-related virtual assets/stablecoins; CMA exchanges/tokenisation). Implementing VASP Regulations 2026 in draft (consultation closed 10 Apr 2026), not confirmed gazetted as of 24 Jun 2026; stablecoin-issuer capital floor ~KES 500m proposed. Movement — CHANGED VASP Regulations 2026 stablecoin reserve/redemption/reporting regime fully detailed_Additional detail on stablecoin prudential requirements confirmed this cycle._ Horizon · 2026-H2 (±half_year) Kenya VASP Regulations 2026 (implementing subsidiary rules) finalisation/gazette_consultation · T3_ Standing sub-brief · as of 24 June 2026 272 words · last cycle 2026-10-18 #### Stablecoins & Digital Money The defining digital-money development for Kenya is the Virtual Asset Service Providers Act 2025, assented in October 2025 (Act No. 20 of 2025, gazetted 21 October 2025) and in force from 4 November 2025. The Act establishes a dual-regulator model that crosses the bank and non-bank lines: the CBK licenses payment-related virtual assets — stablecoin dealers, virtual asset wallet providers, virtual asset payment processors and stablecoin-issuance providers — while the Capital Markets Authority supervises exchanges, brokers and tokenisation platforms. The Act brings stablecoin payment rails into a supervised perimeter. The central commercial gap is between the in-force Act and its still-draft implementing regulations. Draft National Treasury VASP Regulations 2026 set the heaviest capital requirement on stablecoin issuers at KES 500 million (~USD 3.8m), counting only fully paid-up funds, with licensing fees ranging from KES 100,000 to KES 2 million (the highest on exchanges and stablecoin payment processors) and joint CBK/CMA oversight aligned to FATF AML/CFT standards. Consultation closed on 10 April 2026, but the regulations were not confirmed gazetted as of 24 June 2026, and no VASP had been licensed. For these reasons confidence is held at Assessed, with an explicit pending caveat, rather than High. #### Outlook The W2 trajectory is escalating. The key forward signal is finalisation and gazette of the VASP Regulations 2026, expected in the second half of 2026, which would operationalise the licensing categories, the ~KES 500m stablecoin-issuer capital floor and the reserve rules. Whether gazette and licensing commencement have occurred is an explicit gap flagged for diffing against the first periodic run; emerging-market crypto-rule operationalisation is under-indexed and should be re-confirmed next cycle. Periodic update · new data 2026-10-18 #### Stablecoins & Digital Money The Virtual Asset Service Providers Regulations, 2026, in force since 22 July 2026, establish a detailed stablecoin regime under Central Bank of Kenya licensing. Issuers must maintain full reserve backing such that the value of reserve assets equals or exceeds the nominal value of all outstanding stablecoin units at all times, with those reserve assets held in pools segregated both from the issuer's own operating assets and from the reserves backing any other stablecoin the issuer may manage. Holders have a statutory right to redeem their holdings at par value within two working days of a redemption request, and issuers are expressly prohibited from paying interest on stablecoin holdings — a structural design choice that positions Kenyan-regulated stablecoins as payment instruments rather than yield-bearing products. This stablecoin framework operates independently of, and is already further advanced than, the draft National Payment System Bill, 2026's broader PSP licensing overhaul: the stablecoin reserve, segregation and redemption requirements are already in force and being applied to licensed issuers, while the wider payments-licensing restructuring remains at the draft-Bill consultation stage. The two regimes will eventually need to be read together, particularly if the draft Bill's proposal to bring payment-related virtual-asset activity within the payments perimeter proceeds, potentially creating overlapping supervisory touchpoints between CBK's existing stablecoin oversight and any new payments-specific licensing requirement for the same activity. #### Outlook The practical operation of the reserve-backing, segregation and par-redemption requirements will be the main thing to watch as licensed stablecoin issuers continue operating under the regime; separately, the fate of the draft National Payment System Bill's VASP-payments provision will determine whether a second layer of licensing is eventually added on top of the existing stablecoin framework. **Sources and findings (4)** 1. T1 Kenya VASP Act 2025 (in force 4 Nov 2025); draft VASP Regs 2026 (CBK/CMA) (centralbank.go.ke) 2. T1 Draft VASP Regulations 2026 — consultation closed 10 Apr 2026 (centralbank.go.ke) 3. T3 [https://thecurrencyanalytics.com/altcoins/new-kenyan-regulations-demand-capital-buffers-for-crypto-companies-252352 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://thecurrencyanalytics.com/altcoins/new-kenyan-regulations-demand-capital-buffers-for-crypto-companies-252352 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 4. T3 [https://www.afriwise.com/blog/kenya-now-has-a-crypto-law-virtual-asset-service-providers-vasp-bill-2025 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.afriwise.com/blog/kenya-now-has-a-crypto-law-virtual-asset-service-providers-vasp-bill-2025 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) ### W3 Operational Resilience & Critical Infra Confirmed confirmed 2026-06-24 Operational resilience for non-bank PSPs is anchored in the CBK Guideline on Cybersecurity for Payment Service Providers (July 2019), issued under s.31(2)(b) NPS Act, mandating board-level cyber governance, a CISO, written policies, dependency/third-party risk management and a 24-hour incident-notification obligation to CBK plus quarterly reporting. Banks follow the separate 2017 Guidance Note on Cybersecurity. The Kenya Electronic Payment and Settlement System (KEPSS) is the systemically important RTGS. M-Pesa's September 2025 'Fintech 2.0' core migration reflects active resilience/critical-infra modernisation. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/kenya/) Standing sub-brief · as of 24 June 2026 231 words · last cycle 2026-10-11 #### Operational Resilience & Critical Infrastructure Operational resilience for non-bank PSPs in Kenya is anchored in the CBK Guideline on Cybersecurity for Payment Service Providers (July 2019), issued under section 31(2)(b) of the NPS Act. The guideline mandates board-level cyber governance, a non-outsourceable CISO, written policies, third-party and dependency risk management, a 24-hour incident-notification obligation to the CBK and quarterly incident-handling reporting. Banks follow a separate 2017 Guidance Note, maintaining the bank/non-bank distinction at the resilience layer. No consolidated DORA-equivalent statute has been identified; resilience runs through the cyber guideline and ICT risk-management guidelines rather than a single instrument, a gap relative to EU peers. The live operational event is Safaricom's migration of M-Pesa to a new modular core branded 'Fintech 2.0', completed in a maintenance window on 22 September 2025 in a roughly three-hour cutover from the prior G3 architecture — the most significant platform upgrade since 2015, designed to lower system-wide outage risk. As a dashboard-tier dated item: M-Pesa is de facto critical national payment infrastructure, handling transaction activity equivalent to roughly 8% of GDP, so a core re-platform materially affects system-wide resilience and integration capacity. KEPSS remains the systemically important RTGS underpinning settlement. #### Outlook The W3 trajectory is stable. The standing watch item is whether a consolidated DORA-style operational-resilience instrument emerges; none is in force per the absent-field provenance, and the current regime rests on the 2019 cyber guideline. Periodic update · new data 2026-10-11 #### Operational Resilience & Critical Infrastructure The Draft National Payment System Bill, 2026 proposes a substantial expansion of the Central Bank of Kenya's supervisory and intervention toolkit over licensed payment providers. The draft would grant the CBK powers to enter and inspect a licensed provider's premises, with or without prior notice, remove responsible officers found unfit, restrict a provider's business activity, intervene directly in a provider's management, and revoke a provider's licence altogether for non-compliance. These powers would apply across the new licence taxonomy proposed under the same draft Bill, meaning payment initiation service providers, account information service providers, merchant acquirers, electronic wallet providers, electronic money issuers, payment gateways and payment messaging operators would all sit within this expanded supervisory perimeter once the Bill is enacted. Alongside these supervisory powers, the draft Bill proposes a mandatory incident-notification duty: payment providers would be expected to notify the CBK of significant incidents, expressly including cyberattacks, data breaches and major service disruptions. This notification duty would give the CBK visibility into operational-resilience events across the payments sector in a way the current National Payment System Act, 2011 framework does not appear to provide on the evidence available this cycle. Both the expanded supervisory powers and the incident-notification duty remain proposals; the draft Bill has not been enacted, and the consultation period on its text closed on 9 October 2026. The practical effect of these provisions on payment-provider operational practice will depend on how the Bill is finalised following that consultation. #### Outlook Whether the incident-notification thresholds and reporting timelines are specified in more granular detail as the Bill moves toward enactment is the key item to watch. The expanded entry-and-inspection powers, if enacted as drafted, would represent a materially more interventionist supervisory posture for the CBK over payment providers than currently exists under the 2011 Act. **3 earlier distinct update(s)** Periodic update · new data 2026-09-28 #### Operational Resilience & Critical Infrastructure The draft National Payment System Bill, 2026 would grant the Central Bank of Kenya new emergency powers to seize control of failing payment companies and appoint statutory managers for up to 12 months. This is a resolution-and-continuity provision distinct from the Bill's licensing and safeguarding provisions: rather than governing entry into the market or the treatment of customer funds in the ordinary course, it governs what happens when a licensed payment company fails or is at risk of failing. The up-to-12-month duration for a statutory manager's appointment indicates a resolution window intended to allow either an orderly wind-down or a stabilisation and return to normal operation, rather than an immediate liquidation-only pathway. Granting CBK this direct intervention authority extends its supervisory reach beyond routine licensing and conduct oversight into a more active continuity-management role for the payments sector specifically, distinguishing critical payment infrastructure from ordinary commercial failure in the way the draft framework proposes to treat it. This provision was published as part of the same 22 September 2026 draft Bill addressed elsewhere in this jurisdiction's coverage, and is subject to the same public comment period closing 9 October 2026. #### Outlook The scope and conditions attached to CBK's proposed emergency intervention powers — including any threshold for their exercise and the specific obligations of an appointed statutory manager — are likely to be a focus of comment during the consultation period. Whether this resolution power survives the legislative process in its current form, and how it interacts with existing insolvency law, is the key open question for this module going forward. Periodic update · new data 2026-09-21 #### Operational Resilience & Critical Infrastructure The Central Bank of Kenya has issued a Cybersecurity Guideline for Payment Service Providers, exercising its powers under section 31(2)(b) of the National Payment System Act, 2011. This adds a further operational-resilience obligation layer to the existing payments licensing framework, and it is confirmed via CBK's own payment-systems publication channel, giving it primary-source standing even though the detailed text of the guideline itself was not independently opened and reviewed this cycle. The existence of a dedicated cybersecurity instrument, distinct from general licensing conditions, signals that CBK is treating operational and cyber resilience as a discrete supervisory concern warranting its own guidance document rather than folding it into generic conduct rules. This development should be read alongside the same cycle's confirmation of CBK's broad PSP jurisdiction under W1a: a regulator whose jurisdiction has just been judicially confirmed as extending to any person engaged in any payment-system process is also, in the same period, formalising a dedicated cybersecurity expectation for that same wide population of regulated entities. The combined signal is one of a regulator consolidating both the scope and the substantive depth of its supervisory reach concurrently. What remains unconfirmed this cycle is the guideline's specific content: incident-reporting timelines, minimum control standards, third-party risk-management expectations, and any certification or attestation requirements were not evidenced from primary text. PSPs operating in Kenya should treat the guideline's existence as confirmed and its detailed compliance requirements as an open research item pending direct review of the primary document. #### Outlook The key development to track is whether CBK follows the Cybersecurity Guideline's issuance with active supervisory examinations, incident-reporting enforcement, or public guidance clarifying compliance timelines. Given that the guideline was issued under an explicit statutory power (NPS Act s.31(2)(b)) rather than informal advisory channels, it carries the standing of a binding regulatory instrument, and its practical bite will depend on whether CBK follows through with examination or enforcement activity in the coming cycles. Periodic update · new data 2026-09-05 #### Operational Resilience & Critical Infrastructure Kenya's core settlement infrastructure is being incrementally modernised. The Kenya Electronic Payment and Settlement System extended its operating hours to 7:00am-7:00pm on business days from July 2025, a bank-side change to the country's high-value interbank settlement rail intended to improve liquidity management and settlement efficiency, part of the broader National Payments Strategy 2022-2025 modernisation programme. Separately, and at an earlier stage of development, CBK is building a Fast Payment System intended to enable instant transfers across banks, mobile wallets and fintechs. Unlike KEPSS, which is bank-anchored, the Fast Payment System is explicitly conceived to span both bank and non-bank participants; however, its institutional governance framework and the technology-infrastructure options underpinning it are still being established, and no operative system exists this cycle. This is best characterised as an early-stage, UPI-like ambition rather than a near-term deliverable. #### Outlook The resolution of the Fast Payment System's governance and technology-infrastructure questions is the clearest medium-term marker for Kenya's resilience and instant-payments trajectory. Whether the system is built as a CBK-operated utility or delegated to an industry consortium, and whether non-bank participants receive direct access or must connect through sponsoring banks, will determine how far it departs from today's bank-anchored settlement model. **Sources and findings (4)** 1. T1 [https://www.centralbank.go.ke/2019/07/05/cybersecurity-guideline-for-payment-service-providers/](https://www.centralbank.go.ke/2019/07/05/cybersecurity-guideline-for-payment-service-providers/) retrieved 2026-06-24 2. T3 [https://cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-security-laws/kenya [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-security-laws/kenya [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 3. T3 [https://bowmanslaw.com/insights/cybersecurity-in-the-payment-service-space/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://bowmanslaw.com/insights/cybersecurity-in-the-payment-service-space/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 4. T3 [https://moseskemibaro.medium.com/m-pesa-reloaded-the-reasons-why-safaricoms-fintech-2-0-02348f2eefe4 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://moseskemibaro.medium.com/m-pesa-reloaded-the-reasons-why-safaricoms-fintech-2-0-02348f2eefe4 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) ### W4 Scheme & Network Compliance Probable confirmed 2026-06-24 Card-scheme compliance in Kenya operates through the global Visa/Mastercard rulebooks and PCI DSS enforced via acquirers; Kenyan PSPs such as Pesapal hold PCI DSS Level 1 certification. Kenya completed an EMV chip migration ('Great Migration to EMV Chip', 2013). Scheme programmes including Visa's consolidated Acquirer Monitoring Program (VAMP, effective April 2025 with tighter thresholds in January 2026) and Mastercard SDP apply to Kenyan acquirers. There is no domestic interchange-cap regulation comparable to the EU IFR identified; interchange is governed by scheme rules. Standing sub-brief · as of 24 June 2026 205 words · last cycle 2026-06-24 #### Scheme & Network Compliance Card-scheme compliance in Kenya operates through the global Visa and Mastercard rulebooks and PCI DSS, enforced via acquirers. Visa's consolidated Acquirer Monitoring Program (VAMP) took effect on 1 April 2025, with tighter thresholds from January 2026 and merchant assessment from October 2025; Mastercard's Site Data Protection programme applies in parallel. These scheme rules flow down to Kenyan acquirers — both bank-led and non-bank gateways — and interchange is governed by scheme rules rather than statute. No domestic interchange-cap regulation comparable to the EU Interchange Fee Regulation has been identified. Concrete evidence of the scheme/PCI stack in operation comes from Pesapal, a non-bank PSP that is PCI-DSS Level 1 certified and PCI-PIN compliant, demonstrating that Kenyan card-acquiring PSPs operate under the full scheme and PCI compliance stack, including PIN security across the card-processing cycle. The commercial significance is that the January 2026 VAMP threshold tightening raises chargeback and fraud-ratio compliance pressure on Kenyan acquirers without any domestic interchange backstop to cushion the economics. #### Outlook The W4 trajectory is escalating, driven by scheme-rule tightening rather than domestic regulation. The standing gap is whether any national-switch or FPS rollout introduces domestic interchange or pricing rules; none is in force today, and interchange remains scheme-governed. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T2 [https://corporate.visa.com/en/resources/security-compliance.html](https://corporate.visa.com/en/resources/security-compliance.html) retrieved 2026-06-24 2. T3 [https://www.pesapal.com/security](https://www.pesapal.com/security) retrieved 2026-06-24 3. T3 [https://www.decta.com/company/media/how-visa-and-mastercard-ensure-compliance-for-acquirers-and-issuers](https://www.decta.com/company/media/how-visa-and-mastercard-ensure-compliance-for-acquirers-and-issuers) retrieved 2026-06-24 4. T1 [https://www.centralbank.go.ke/national-payments-system/](https://www.centralbank.go.ke/national-payments-system/) retrieved 2026-06-24 ### W5 Payment Corridor Dynamics limited signal Probable confirmed 2026-06-24 Kenya's principal corridors are intra-African and diaspora remittance flows, plus regional East African trade. Domestic rails are mobile-money (M-Pesa dominant) and the bank-owned Pesalink real-time network. Cross-border integration is led by PAPSS: Kenya (via CBK) became the 10th African central bank on PAPSS, and in February 2026 Pesalink became a PAPSS Technical Connectivity Provider, linking 80+ Kenyan institutions to 160+ PAPSS banks for instant local-currency cross-border settlement, reducing reliance on correspondent banking and USD. A CBK Fast Payment System (FPS) was targeted for 2025. Horizon · 2026 (±multi_year) CBK Fast Payment System (national switch) launch_in_force_pending · T3_ Standing sub-brief · as of 24 June 2026 242 words · last cycle 2026-09-05 #### Payment Corridor Dynamics The material corridor development is the integration of Pesalink with PAPSS. Announced on 26 February 2026, Pesalink became a PAPSS Technical Connectivity Provider, connecting 80+ Kenyan bank, fintech, SACCO and telco participants to 160+ commercial banks and fintechs on PAPSS and enabling instant 24/7 cross-border payments settled in local currencies. Kenya, via the CBK, is the 10th African central bank on PAPSS. The strategic effect is to displace USD correspondent chains for intra-African flows, addressing the friction of intra-African remittance costs that averaged 7-8% in 2023 with 3-7 day settlement. On the domestic instant-payments side, the CBK is advancing a Fast Payment System (FPS / national switch) for real-time 24/7 transactions, originally targeted to launch in 2025. In 2025 Safaricom and the Kenya Bankers Association proposed designating Pesalink as the lead FPS. Launch status as of 24 June 2026 is not confirmed, and industry sources from January 2025 suggested the build could take up to four years; the claim is held at Assessed with a currency-lens caveat. A national FPS would open the closed M-Pesa-dominated ecosystem and reshape interoperability economics, but timeline slippage keeps the structural status quo in place. #### Outlook The W5 trajectory is escalating on the cross-border axis (PAPSS live) and stable on the domestic axis (FPS pending). The forward watch item is FPS go-live, expected in 2026 but with a multi-year uncertainty band; emerging-market instant-payment-rail launch timelines are under-indexed and should be verified in periodic runs. Periodic update · new data 2026-09-05 #### Payment Corridor Dynamics Kenya's domestic payment-corridor dynamics are increasingly defined by mandated interoperability rather than by open competition among siloed networks. Under CBK's National Payments Strategy 2022-2025, wallet-to-wallet interoperability is mandated between M-Pesa, Airtel Money and T-Kash, Kenya's three principal mobile-money networks, alongside merchant till-number interoperability across mobile network operators. This mandated interoperability enables seamless instant transfers between customers of different mobile-money providers and materially simplifies payment acceptance for small and medium merchants, who no longer need to maintain separate till arrangements for each network's customer base. This interoperability mandate sits on the non-bank PI/EMI side of Kenya's payments architecture, since mobile-money issuers operate as e-money issuers rather than banks; it complements, rather than substitutes for, the bank-anchored KEPSS settlement rail addressed elsewhere in this cycle's coverage. #### Outlook The durability of Kenya's interoperability mandate as a competitive-neutrality tool will be tested as CBK's Fast Payment System develops; if the FPS incorporates the existing mobile-money interoperability architecture directly, corridor dynamics may consolidate further around a single instant-payments rail, whereas a parallel build could preserve today's more federated model. **Sources and findings (4)** 1. T2 [https://www.afreximbank.com/pesalink-and-papss-unlock-cross-border-payments-in-local-currencies-in-kenya/](https://www.afreximbank.com/pesalink-and-papss-unlock-cross-border-payments-in-local-currencies-in-kenya/) retrieved 2026-06-24 2. T3 [https://www.microsave.net/2025/07/08/the-next-chapter-in-kenyas-digital-payment-revolution/](https://www.microsave.net/2025/07/08/the-next-chapter-in-kenyas-digital-payment-revolution/) retrieved 2026-06-24 3. T3 [https://ibsintelligence.com/ibsi-news/pesalink-and-papss-unlock-cross-border-payments-in-kenya/](https://ibsintelligence.com/ibsi-news/pesalink-and-papss-unlock-cross-border-payments-in-kenya/) retrieved 2026-06-24 4. T3 [https://www.dawan.africa/news/pesalink-and-papss-eliminate-cross-border-payment-barriers-in-kenya](https://www.dawan.africa/news/pesalink-and-papss-eliminate-cross-border-payment-barriers-in-kenya) retrieved 2026-06-24 ### W6 Industry Structure & Commercial Probable confirmed 2026-06-24 Kenya's payments market is telco-mobile-money-dominated: Safaricom's M-Pesa holds ~89.7% of mobile-money market share (Airtel Money ~10.3%), with mobile-money penetration ~91% (June 2025) and ~48.6m subscriptions. M-Pesa transacts activity equivalent to ~8% of GDP and ~44% of Safaricom service revenue. Banks (KCB, Equity, NCBA) participate largely via telco-partnered products (M-Shwari, KCB M-Pesa, Fuliza) and the bank-owned Pesalink rail. The structure is a closed-ecosystem incumbency long criticised for limited interoperability; CBK's national-switch/FPS agenda targets opening it. Standing sub-brief · as of 24 June 2026 164 words · last cycle 2026-10-04 #### Industry Structure & Commercial Dynamics Kenya's payments market structure is a near-monopoly mobile-money ecosystem. Per Communications Authority Q1 FY2025/2026 statistics, M-Pesa holds approximately 89.7% mobile-money market share against Airtel Money's roughly 10.3%, with 48.6 million mobile-money subscriptions and around 91-93% penetration. M-Pesa, a non-bank operator, handles transaction activity equivalent to roughly 8% of Kenya's GDP and processes over 61 million transactions daily, anchoring a long-criticised closed ecosystem. Banks participate via telco-partnered products such as M-Shwari, KCB M-Pesa and Fuliza, and through the bank-owned Pesalink rail. The structural condition is that single-operator dominance defines competitive dynamics, and closed-ecosystem incumbency is precisely what the CBK's FPS and national-switch agenda targets. The judgment is that the FPS and the Pesalink-led instant-payments agenda are the principal levers to open the market, but FPS timeline slippage preserves the incumbent's position. #### Outlook The W6 trajectory is stable. The market-opening dynamics are dependent on developments tracked in W5 (FPS, Pesalink-PAPSS) and W9 (product access); absent FPS go-live, the structural concentration persists. Periodic update · new data 2026-09-28 #### Industry Structure & Commercial Dynamics The Central Bank of Kenya fined a record 33 commercial banks for defying calls to cut loan rates in line with the reduced Central Bank Rate, following on-site inspections covering all 38 commercial banks in Kenya's banking sector. This action, while concerned with lending-rate conduct rather than payments regulation directly, is a relevant industry-structure signal because it demonstrates CBK's willingness to use its supervisory and enforcement toolkit assertively against the bank segment of the market at scale — nearly the entire commercial banking sector was inspected, and the majority of those inspected were fined. This enforcement posture sits alongside, and should be read in the context of, the same period's proposed National Payment System Bill, 2026, which would separately expand CBK's supervisory and resolution powers over the payments sector specifically. Taken together, the two developments point to a Central Bank actively expanding and exercising its regulatory reach across both traditional banking conduct and payments-market structure in the same period, rather than a single isolated action confined to one segment of the financial sector. No further first-party findings on market concentration, new-entrant activity, or competitive dynamics among Kenya's payment-service providers were available this cycle beyond the enforcement action and the pending legislative reform described above. #### Outlook The scale of this enforcement action — a record number of banks fined following comprehensive on-site inspection — suggests continued active supervisory scrutiny of the banking sector's conduct in this period. Whether this translates into a broader pattern of assertive CBK enforcement across the payments sector as the National Payment System Bill, 2026 moves through consultation and toward formal legislative process is a connected question worth tracking alongside the Bill's own progress. **Sources and findings (4)** 1. T3 [https://www.ecofinagency.com/news-finances/2412-51647-safaricom-and-airtel-money-licensed-to-facilitate-capital-markets-access-in-kenya](https://www.ecofinagency.com/news-finances/2412-51647-safaricom-and-airtel-money-licensed-to-facilitate-capital-markets-access-in-kenya) retrieved 2026-06-24 2. T3 [https://business.cornell.edu/article/2025/12/why-fintechs-are-winning-in-nigeria/](https://business.cornell.edu/article/2025/12/why-fintechs-are-winning-in-nigeria/) retrieved 2026-06-24 3. T3 [https://techweez.com/2026/03/28/how-mobile-money-became-kenyas-core-banking-system/](https://techweez.com/2026/03/28/how-mobile-money-became-kenyas-core-banking-system/) retrieved 2026-06-24 4. T3 [https://sdk.finance/blog/fintech-kenya-2025-landscape-overview-growth-drivers-and-barriers/](https://sdk.finance/blog/fintech-kenya-2025-landscape-overview-growth-drivers-and-barriers/) retrieved 2026-06-24 ### W7 Legal & Litigation Probable confirmed 2026-06-24 Payments-relevant litigation/enforcement in Kenya clusters around (a) scope-of-licensing disputes (a 2022 High Court decision extending the PSP definition to SWIFT-infrastructure users; CBK action against unlicensed players such as Flutterwave and Chipper Cash in 2022), and (b) data-protection enforcement against digital lenders by the ODPC (e.g. Mulla Pride Ltd / KeCredit / FairKash; White Path Company). The CBK has run public cautionary notices and enforcement against unlicensed PSPs since 2023. Standing sub-brief · as of 24 June 2026 230 words · last cycle 2026-06-24 #### Legal & Litigation Two litigation clusters define the W7 picture. First, a landmark 2022 High Court decision extended the PSP definition to companies utilising SWIFT banking infrastructure, meaning back-end processors may require licensing. In July 2022 the CBK cautioned banks against dealing with Flutterwave and Chipper Cash as unlicensed, and at the end of 2023 issued a cautionary notice against unlicensed fintechs. The broad judicial reading pulls infrastructure and back-end processors into the licensing perimeter, a material market-access risk for cross-border fintechs serving Kenya. T3-only sourcing keeps this at Assessed. Second, the Office of the Data Protection Commissioner (ODPC) has enforced against digital lenders as a financial-promotion proxy: it fined White Path Company Ltd KES 5m over roughly 150 complaints involving contact-mining and unsolicited messages, and Mulla Pride Ltd (apps KeCredit and FairKash) KES 2.9m for using third-party-obtained contacts to shame borrowers. In Mulla Pride Ltd v ODPC (Petition E420 of 2023) [2025] KEHC 11287, the entity was found to have operated without a CBK licence. From January 2025, debt-shaming and harassment is criminal, with the CBK able to suspend licences and gazette offenders. This raises conduct and compliance cost for the non-bank digital-credit-provider segment. #### Outlook The W7 trajectory is stable on the PSP-scope litigation and escalating on data-protection enforcement against digital lenders. Both clusters remain at Assessed given T3-only sourcing; deeper case-law confirmation would strengthen calibration in future runs. no periodic updates on record for this sub-brief ** Sources and findings (3)** 1. T3 [https://lawzana.com/legal-questions/kenya/what-licenses-are-required-to-operate-a-mobile-payments-service-in-kenya-and-how-do-i-stay-compliant-with-cbk-regulations-1935](https://lawzana.com/legal-questions/kenya/what-licenses-are-required-to-operate-a-mobile-payments-service-in-kenya-and-how-do-i-stay-compliant-with-cbk-regulations-1935) retrieved 2026-06-24 2. T3 [https://riskhouse.co.ke/digital-credit-and-data-protection-in-kenya/](https://riskhouse.co.ke/digital-credit-and-data-protection-in-kenya/) retrieved 2026-06-24 3. T3 [https://mukambalaw.com/digital-lenders/](https://mukambalaw.com/digital-lenders/) retrieved 2026-06-24 ### W8 Merchant Acquiring & Risk Probable confirmed 2026-06-24 Merchant acquiring in Kenya spans bank-led acquiring (Equity/Jambopay, KCB) and non-bank gateways (Pesapal, DPO Group/Tingg via Cellulant, Flutterwave, Paystack, i&M/Direct Pay). Acceptance is dominated by Lipa na M-Pesa till/paybill plus card (Visa/Mastercard/Amex) and QR. Onboarding/risk obligations run through PSP authorisation, PCI DSS, AML/KYC under POCAMLA, and scheme high-risk/BRAM programmes; chargeback/dispute mechanics follow Visa/Mastercard rules. Fraud risk is concentrated in mobile-money social engineering and SIM-swap. Standing sub-brief · as of 24 June 2026 144 words · last cycle 2026-06-24 #### Merchant Acquiring & Risk Kenyan merchant acquiring spans bank-led acquiring (Equity/JengaPay, KCB) and non-bank gateways (Pesapal, DPO Group, Cellulant Tingg, Flutterwave, Paystack), carrying the bank/non-bank distinction directly into the acquiring layer. Acceptance is dominated by Lipa na M-Pesa till and paybill, supplemented by card and QR. Scheme high-risk programmes — Visa BRAM and Mastercard QMAP — require acquirers to manage or terminate offending merchants. Fraud risk is concentrated in mobile-money social engineering and SIM-swap rather than classic card-present fraud. The commercial significance is that a hybrid card-plus-mobile acquiring stack with BRAM/QMAP exposure shapes onboarding economics and chargeback liability for Kenyan acquirers. This sits at Monitored impact and Assessed confidence, reflecting T3-only sourcing on the acquiring market structure. #### Outlook The W8 trajectory is stable. Risk-framework pressure links forward to the W4 scheme-compliance tightening (VAMP thresholds), which feeds chargeback and fraud-ratio management at the acquirer level. no periodic updates on record for this sub-brief ** Sources and findings (3)** 1. T3 [https://payatlas.com/countries/kenya-ke](https://payatlas.com/countries/kenya-ke) retrieved 2026-06-24 2. T3 [https://cnbcode.com/blog/payment-gateways-kenya-complete-guide](https://cnbcode.com/blog/payment-gateways-kenya-complete-guide) retrieved 2026-06-24 3. T3 [https://www.decta.com/company/media/how-visa-and-mastercard-ensure-compliance-for-acquirers-and-issuers](https://www.decta.com/company/media/how-visa-and-mastercard-ensure-compliance-for-acquirers-and-issuers) retrieved 2026-06-24 ### W9 Product Innovation & Market Development Probable confirmed 2026-06-24 Innovation is rail- and product-led: the CBK Fast Payment System (national switch) initiative, the M-Pesa 'Fintech 2.0' core re-platform (Sept 2025), the Pesalink–PAPSS cross-border rail (Feb 2026), open-banking/open-finance discussions, and embedded credit (Fuliza, M-Shwari, KCB M-Pesa). The CMA licensed Safaricom and Airtel Money as Intermediary Service Platform Providers (Dec 2025) to channel capital-markets products via mobile. M-Pesa's Daraja API (now Daraja 3.0, Nov 2025) underpins developer integration despite long-standing openness criticism. Standing sub-brief · as of 24 June 2026 182 words · last cycle 2026-10-11 #### Product Innovation & Market Development Two product-access developments stand out. On 22 December 2025 the Capital Markets Authority granted Safaricom and Airtel Money Kenya licences to operate as Intermediary Service Platform Providers (ISPPs), connecting mobile-money users to regulated capital-markets products via apps, USSD and agent networks — expanding access to investments, savings and insurance. This turns telco wallets into capital-markets distribution channels, widening the addressable product set for mobile-money incumbents. As a dashboard-tier dated item, Safaricom launched Daraja 3.0 in November 2025, now cloud-native with improved reliability, faster onboarding and new security APIs, addressing long-standing developer criticism of M-Pesa's closed, bureaucratic integration model relative to India's UPI. The underlying Fintech 2.0 modular platform enables faster integrations and AI-guided fraud detection. A modernised Daraja API lowers integration friction for fintechs building on M-Pesa, partially answering the openness criticism. Both developments concern the non-bank mobile-money segment. #### Outlook The W9 trajectory is established. Product-access developments here interact with the structural opening dynamics tracked in W5 (FPS) and W6 (market concentration); the ISPP and Daraja moves widen distribution and integration without yet displacing the closed-ecosystem structure. Periodic update · new data 2026-10-11 #### Product Innovation & Market Development The Draft National Payment System Policy, 2026, published by the Central Bank of Kenya, proposes a national instant-payment switch delivering 24/7 real-time interoperability across banks, mobile-money providers and other payment providers. This proposed switch would build on existing settlement rails already operating in Kenya, including Pesalink and the Integrated Payment Services Limited (IPSL) infrastructure, rather than replacing them outright. The companion Draft National Payment System Bill, 2026 gives this policy ambition legislative teeth: Clause 28 of the draft Bill would require payment systems to be interoperable and would empower the CBK to mandate interoperability where it is not achieved voluntarily. The same draft Bill's Clause 29 would require consent-based secure customer-data-sharing systems and explicitly envisages future open-finance regulations, positioning Kenya's payments reform alongside an open-API standards agenda. Taken together, the instant-payment-switch proposal and the open-finance clause represent a two-part product-innovation push: one aimed at settlement-layer interoperability and real-time payment rails, the other aimed at data-sharing infrastructure that would underpin future open-banking-style products built on top of those rails. Both the Policy and the Bill remain in draft form as of the close of public comment on 9 October 2026. Neither the instant-payment switch nor the open-finance regulations envisaged under Clause 29 have a confirmed implementation date at this stage. #### Outlook The sequencing between the Bill's enactment and any subsequent open-finance regulations under Clause 29 is the item to track, since the Clause 29 regulations are themselves contingent on the Bill first becoming law. Separately, whether the proposed instant-payment switch is built as an extension of Pesalink/IPSL or as a distinct new system will shape how quickly the 24/7 interoperability goal is achieved once the legislative framework is in place. **2 earlier distinct update(s)** Periodic update · new data 2026-09-28 #### Product Innovation & Market Development The draft National Payment System Bill, 2026 would require payment providers to build systems for secure customer-data sharing for what the draft terms 'open finance purposes', with the Central Bank of Kenya empowered to mandate such sharing on customer consent. This is a structural product-access provision rather than a conduct or licensing rule: it would create a data-portability obligation across Kenya's payment-services sector, conditioned on customer consent, that does not currently exist under the National Payment System Act 2011. Separately, but published as part of the same reform package, the companion draft National Payment System Policy, 2026 floats a national instant-payment switch, described as intended to move transactions quickly and cheaply across the entire payment ecosystem regardless of provider. An infrastructure proposal of this kind, if it proceeds, would sit alongside existing private payment rails rather than necessarily replacing them, and its stated aim — moving transactions across the ecosystem regardless of provider — points toward an interoperability objective for Kenya's payments infrastructure. Both the open-finance data-sharing obligation and the instant-payment-switch proposal are, at this stage, draft provisions subject to the public comment period on the Bill and Policy, which closes 9 October 2026. #### Outlook The open-finance data-sharing mandate and the instant-payment-switch proposal represent two distinct but complementary product-innovation vectors within the same draft reform package. Whether either proceeds beyond the draft stage, and in what form, depends on the outcome of the consultation period closing 9 October 2026 and any subsequent legislative process. Periodic update · new data 2026-09-05 #### Product Innovation & Market Development Kenya's digital-payments market is projected to grow at a compound annual growth rate of between 14.1% and 26.16% from 2024 to 2029, reaching approximately USD 24 billion in transaction value by the end of that period, with M-Pesa remaining the anchor product underpinning the projection. This scale of projected growth is significant less for the number itself than for what it implies about CBK's regulatory posture: the central bank has positioned itself as a policy-led enabler of this growth trajectory, investing in settlement-hours extension and Fast Payment System development ahead of continued mobile-money-led expansion, rather than regulating reactively in response to disruption after the fact. Open banking and related product-innovation frameworks remain at an early stage in Kenya relative to this growth trajectory, though no specific open-banking instrument or timeline was identified in this cycle's evidence base beyond the general policy-enabler characterisation. #### Outlook Whether CBK's enabler posture converts into a formal open-banking or broader product-innovation regulatory framework, as opposed to continued informal policy support for market-led growth, is the development to watch. The scale of projected market growth increases the stakes of getting that framework right, particularly for how non-bank product innovators are treated relative to incumbent mobile-money operators. **Sources and findings (4)** 1. T3 [https://www.ecofinagency.com/news-finances/2412-51647-safaricom-and-airtel-money-licensed-to-facilitate-capital-markets-access-in-kenya](https://www.ecofinagency.com/news-finances/2412-51647-safaricom-and-airtel-money-licensed-to-facilitate-capital-markets-access-in-kenya) retrieved 2026-06-24 2. T3 [https://www.microsave.net/2025/07/08/the-next-chapter-in-kenyas-digital-payment-revolution/](https://www.microsave.net/2025/07/08/the-next-chapter-in-kenyas-digital-payment-revolution/) retrieved 2026-06-24 3. T3 [https://techtrendske.co.ke/2025/11/18/m-pesa-platform-overhaul-safaricom-strategy/](https://techtrendske.co.ke/2025/11/18/m-pesa-platform-overhaul-safaricom-strategy/) retrieved 2026-06-24 4. T3 [https://cnbcode.com/blog/payment-gateways-kenya-complete-guide](https://cnbcode.com/blog/payment-gateways-kenya-complete-guide) retrieved 2026-06-24 ### W10 Consumer Protection & APP Fraud Probable confirmed 2026-06-24 No UK-PSR-style mandatory APP-fraud reimbursement in force; CBK developing a formal e-money/digital-wallet fraud compensation framework under NFIS 2025-2028 targeted end-2026 (pending). DCP Regulations 2022 + Business Laws Amendment 2024/2025 (interest cap, harassment ban) in force. Horizon · 2026 (±year) CBK e-money/digital-wallet fraud compensation framework (NFIS 2025-2028)_proposed · T3_ Standing sub-brief · as of 24 June 2026 253 words · last cycle 2026-06-24 #### Consumer Protection & APP Fraud The forward-looking consumer-protection signal is the CBK's plan, developed under the Kenya National Financial Inclusion Strategy 2025-2028 with the Competition Authority, to establish formal compensation rules for e-money and digital-wallet fraud. It is committed for implementation by end-2026 and would add digital complaint systems, pricing transparency and provider capacity-building. Crucially, no UK-PSR-style mandatory APP-fraud reimbursement regime is in force yet — this is a pending framework, against a backdrop where FinAccess 2024 found 9.8% of mobile-money users experienced direct fraud loss, well above banking channels. A mandatory fraud-redress regime would shift liability onto mobile-money providers and materially alter fraud-cost economics. The in-force complement is the CBK Digital Credit Providers Regulations 2022 (gazetted March 2022), which placed digital lenders under oversight — roughly 227 DCPs licensed by early 2026, up from an initial 85 of more than 700 applications. This is strengthened by the Business Laws (Amendment) Act 2024/2025, which bans harassment, and the in-duplum rule (s.44A) caps interest and penalties at the principal once doubled, with fines up to KES 500,000 or licence revocation. Consumer complaints reportedly fell from around 4,000 a month to a handful. DCP licensing, the interest cap and the harassment ban reshape unit economics and conduct risk for the non-bank digital-lending segment. #### Outlook The W10 trajectory is escalating. The key pending instrument to diff each periodic run is the e-money/digital-wallet fraud compensation framework, targeted for end-2026 with a year-band uncertainty; whether it is implemented and on what liability model is the principal watch item. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T3 [https://serrarigroup.com/cbk-to-roll-out-compensation-rules-for-e-money-and-digital-wallet-fraud/](https://serrarigroup.com/cbk-to-roll-out-compensation-rules-for-e-money-and-digital-wallet-fraud/) retrieved 2026-06-24 2. T3 [https://nation.africa/kenya/blogs-opinion/blogs/easy-money-endless-misery-the-dark-side-of-kenya-s-digital-lending-apps-5081400](https://nation.africa/kenya/blogs-opinion/blogs/easy-money-endless-misery-the-dark-side-of-kenya-s-digital-lending-apps-5081400) retrieved 2026-06-24 3. T3 [https://manwaadvocates.com/legal-protections-for-consumers-in-unfair-lending-practices-in-kenya/](https://manwaadvocates.com/legal-protections-for-consumers-in-unfair-lending-practices-in-kenya/) retrieved 2026-06-24 4. T3 [https://techtrendske.co.ke/2025/09/28/cbk-digital-fraud-compensation-plan-mobile-money/](https://techtrendske.co.ke/2025/09/28/cbk-digital-fraud-compensation-plan-mobile-money/) retrieved 2026-06-24 ### W11 AML/CFT & Financial Crime (Sentinel.gi-fed) [Sourced from Sentinel.gi ↗](https://sentinel.gi/jurisdictions/kenya/#sec-dom-D7) Confirmed confirmed 2026-06-24 SENTINEL-FED CARRY: Kenya on FATF grey list (placed Feb 2024, retained Jun 2026 plenary) and EU high-risk third-country list (10 Jun 2025); AML Amendment Act 2025 + VASP Act remediation; payments impact is EDD + correspondent-banking de-risking pressure. Standing sub-brief · as of 24 June 2026 234 words · last cycle 2026-06-24 #### AML/CFT & Financial Crime (Sentinel-fed) This module is sourced from the Sentinel feed; WPM carries the payments-context impact only and does not re-analyse illicit finance. Per the Sentinel-fed FATF record, Kenya is a jurisdiction under increased FATF monitoring (grey list), placed in February 2024 and retained through the June 2026 plenary cycle, working with FATF on an agreed AML/CFT/CPF action plan. Kenya is also on the EU high-risk third-country list (added 10 June 2025). For payments, the consequence is enhanced due diligence and correspondent-banking de-risking pressure on Kenyan flows. (Source: FATF country detail, via Sentinel feed.) On remediation, also via the Sentinel feed: on 17 June 2025 President Ruto signed the AML and Combating of Terrorism Financing Laws (Amendment) Act 2025 to address FATF-cited deficiencies — enhancing Financial Reporting Centre oversight, mandating enhanced due diligence on high-risk customers and PEPs, stricter KYC and more frequent STR reporting. POCAMLA (Cap 323, 2009) remains the primary AML statute establishing the FRC; the NPS Regulations 2014 carry AML obligations for mobile-money providers; and VASPs are reporting institutions under the VASP Act. The payments-context impact is the KYC and STR burden; deeper illicit-finance analysis is routed to FIM. #### Outlook The W11 trajectory is escalating, with grey-list status retained and remediation underway. Original grey-list-exit assessment and illicit-finance dynamics belong in FIM via the cross-monitor flag; WPM tracks only the EDD and de-risking spillover into settlement and access (see W12). no periodic updates on record for this sub-brief ** Sources and findings (8)** 1. T3 [https://www.fluxforce.ai/jurisdictions/kenya](https://www.fluxforce.ai/jurisdictions/kenya) retrieved 2026-06-24 2. T? FIM (sentinel.gi) per-JID baseline profile — Kenya — Kenya's AML/CFT regime rests on the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) as amended post-2022 MER, supervised by the Financial Reporting Centre (FIU), Central Bank of Kenya and Capital Markets Authority. Grey-listed by FATF since February 2024; reforms since include a VASP licensing framework and increased TF investigations, but core supervisory, BO/trust and NPO gaps persist. 3. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-005) — Gap: regulatory-failure 4. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: enforcement-absence 5. T1 FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-005) — Enforcement: FATF / ESAAMLG — Kenya's national AML/CFT regime 6. T1 FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-004) — Enforcement: FATF / ESAAMLG — Kenya's virtual-asset and CFT regime 7. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: capacity-deficit 8. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: legal-gap ### W12 Correspondent Banking, Settlement & Access Probable confirmed 2026-06-24 KEPSS RTGS settlement with bank accounts at CBK; correspondent-banking de-risking pressure from FATF grey/EU high-risk listing; Pesalink as PAPSS Technical Connectivity Provider (26 Feb 2026) enabling local-currency cross-border settlement displacing USD chains. Standing sub-brief · as of 24 June 2026 238 words · last cycle 2026-06-24 #### Correspondent Banking, Settlement & Access The analytical spine of this structural module is the bank versus non-bank access asymmetry at the settlement layer. The Kenya Electronic Payment and Settlement System (KEPSS) is Kenya's Real Time Gross Settlement system, where transactions are cleared and settled continuously with commercial banks holding settlement accounts at the CBK. Non-bank PSPs do not access KEPSS directly; they settle via banks holding KEPSS accounts — a structural dependency for fintech settlement. Bank licensing, including foreign-bank subsidiary or branch entry, sits under the Banking Act (Cap 488), with additional scrutiny and longer approval where the parent sits in a FATF grey- or black-list jurisdiction. At the cross-border layer, correspondent-banking access is under de-risking pressure amplified by FATF grey-listing and EU high-risk listing, triggering enhanced due diligence, manual review queues that add days to settlement and more expensive trade finance. The WPM lens here is narrowly on settlement and access friction; the root AML dynamics are carried via the W11 Sentinel feed and routed to FIM. The strategic response is PAPSS local-currency settlement, explicitly designed to reduce reliance on USD correspondent chains — making PAPSS adoption (W5) the direct commercial mitigation for de-risking-driven settlement latency and cost. #### Outlook The W12 trajectory is escalating. The structural watch item is the pace of PAPSS uptake against continued de-risking pressure; an AML status improvement (W11/FIM) or deeper PAPSS integration would ease the settlement-access constraint, while grey-list retention sustains it. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.centralbank.go.ke/national-payments-system/](https://www.centralbank.go.ke/national-payments-system/) retrieved 2026-06-24 2. T3 [https://www.crowdfundinsider.com/2026/03/264410-kenyas-pesalink-pan-african-payment-and-settlement-system-target-cross-border-payment-simplicity/](https://www.crowdfundinsider.com/2026/03/264410-kenyas-pesalink-pan-african-payment-and-settlement-system-target-cross-border-payment-simplicity/) retrieved 2026-06-24 3. T3 [https://sanctionslawyers.net/blog-en/the-fatf-grey-list-and-blacklist-complete-guide/](https://sanctionslawyers.net/blog-en/the-fatf-grey-list-and-blacklist-complete-guide/) retrieved 2026-06-24 4. T3 [https://www.fluxforce.ai/jurisdictions/kenya](https://www.fluxforce.ai/jurisdictions/kenya) retrieved 2026-06-24 ### W13 Commercial Intelligence (M&A, Investment & Product) limited signal Probable confirmed 2026-06-24 Trailing-12-month KE commercial intelligence dominated by KCB Group vertical integration into payments: 75% of Riverbank Solutions (~KES 2bn, Mar 2025, completed) and an announced minority stake in Pesapal (31 Oct 2025, undisclosed, pending CBK approval as of Mar 2026). Horizon · 2026 (±year) KCB-Pesapal minority-stake acquisition CBK regulatory approval_in_force_pending · T3_ Horizon · 2026 (±year) KCB-Pesapal minority-stake acquisition CBK regulatory approval_in_force_pending · T3_ Standing sub-brief · as of 24 June 2026 222 words · last cycle 2026-10-18 #### Commercial Intelligence (M&A, Investment & Product) The W13 commercial picture is dominated by a single bank-into-fintech vertical-integration pattern led by KCB Group, rendered here as two discrete M&A events. First, a completed deal: in March 2025 KCB acquired a 75% controlling stake in Riverbank Solutions for about KES 2 billion (~USD 15.4m, disclosed value), bringing agency-banking, revenue-collection and payments infrastructure into the group as the first leg of its full-stack payments platform strategy. Second, a pending deal: on 31 October 2025 KCB announced an agreement to acquire a minority stake in CBK-licensed PSP Pesapal Limited — value not publicly disclosed — subject to regulatory approval, to deepen its push into merchant acquiring and SME payments. As of an 11 March 2026 investor briefing the deal was still awaiting regulatory approval. Pesapal is licensed across Kenya, Uganda, Tanzania, Rwanda and Zambia, so the transaction would extend KCB's reach across five East African markets. Together these events confirm a bank-into-fintech vertical-integration pattern: traditional lenders moving into merchant acquiring and regional payment rails. #### Outlook The W13 trajectory is escalating. The key forward signal is CBK regulatory approval of the KCB-Pesapal minority stake, expected in 2026; the deal value remains undisclosed and the completion date is not yet available. Private-company deal terms are under-indexed and the completion and any disclosed value should be tracked next run. Periodic update · new data 2026-10-18 #### Commercial Intelligence & Fintech Kenya's iGaming market, used here as a proxy indicator for consumer-facing digital-payments activity, recorded a 29.5% quarter-on-quarter increase in demand through the third quarter of 2026. This growth signal arrives against the backdrop of two significant regulatory developments proceeding in parallel: the draft National Payment System Bill, 2026 consultation, which closed 9 October 2026, and the already-operative stablecoin regime under the Virtual Asset Service Providers Regulations, 2026. The demand growth figure, while drawn from a single consumer-vertical proxy rather than broad-based payments-volume data, is consistent with continued expansion of digitally-mediated consumer transaction activity in Kenya during a period when the underlying payments regulatory architecture is being substantially reworked. No discrete commercial transaction — acquisition, investment round, or product launch — specific to Kenya's payments or fintech sector was identified in the research underlying this cycle; the only commercial-intelligence signal available this cycle is this aggregate demand datapoint. #### Outlook Further quarters of demand data will clarify whether the growth rate observed in the third quarter of 2026 is sustained, and whether it correlates with the eventual implementation timeline of the draft National Payment System Bill, 2026 and the ten-category licensing structure it proposes. **Sources and findings (3)** 1. T3 [https://techcabal.com/2025/11/03/kcb-group-buy-minority-payments-firm-pesapal/](https://techcabal.com/2025/11/03/kcb-group-buy-minority-payments-firm-pesapal/) retrieved 2026-06-24 2. T3 [https://kenyanwallstreet.com/kcb-expands-payment-infrastructure-footprint-with-pesapal-minority-stake](https://kenyanwallstreet.com/kcb-expands-payment-infrastructure-footprint-with-pesapal-minority-stake) retrieved 2026-06-24 3. T3 [https://techcabal.com/2026/03/11/kcb-plans-to-aquire-pesapal-underway/](https://techcabal.com/2026/03/11/kcb-plans-to-aquire-pesapal-underway/) retrieved 2026-06-24 ** No modules match.** Filters combine as OR inside a group and AND across groups. ## Editorial metadata Provenance only. Nothing below gates publication or affects the render. Editorial metadata for Kenya| Field | Value | |---|---| | `trust.lawyer_review.status` | never_reviewed | | `trust.lawyer_review.reviewer` | no reviewer on record | | ` trust.content_source` | ai_generated | ## Provenance and declared absence **Disclosure model:** module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. **Sentinel-fed modules** receive no special rendering treatment. `sentinel_feed` is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. **Family taxonomy** is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. **Suppressed by doctrine:** derived risk score; per-module RAG traffic light; `derived_scores` = `{}`. **Band honesty:** uncertainty bands are computed against a frozen build clock of 2026-10-21. A year-precision row is never promoted into a tighter band. **Orphan deltas:** 0 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. **Envelope:** baseline resolved at `jurisdiction_json.baseline`; 14 module(s), 58 finding(s), 126 source(s) in the cumulative register. Think something on this page is wrong? [Report an error](https://payments.gi/legal/#contact).