More Rules, Same Problem? Regulating Digital Debt Collection in Kenya
In recent years, Kenya’s lending market has expanded, especially in the wake of fintech. The country has a population of about 54 million people (Kenya National Bureau of Statistics, 2026), which makes it a growing market for digital lenders seeking markets to deploy their financial products. To capitalize on this market, digital lenders have emerged as a specific fintech type, offering services to a majority of Kenyans. The rise of these new players created regulatory cracks that weakened consumer protection. Given this regulatory opacity, digital lenders sought both formal and informal debt collection strategies to recover their loans. These informal strategies involved mining phonebooks of borrowers, calling, texting, and threatening borrowers and their relatives and friends or threatening to expose their debts to the public, spouses, or their employers. This practice led to several complaints and repression by consumer rights groups.
In exercising its regulatory mandate, the Central Bank of Kenya (the CBK) released two regulatory instruments to curb informal debt collection in the digital space. However, despite the adoption of laws and regulations to curb abusive debt collection, the problem still persists. Thus, the question that lingers is: why do abusive debt collection practices persist despite the introduction of specific legal protections? To probe into this question, we shall in turns assess the Non-Deposit Taking Credit Providers Regulations and the Draft Financial Consumer Protection Framework for Kenya and the challenges thereof.
The Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026 (the NDTCP)
Before the NDTCP, the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 (the 2022 Regulations) represented the first regulatory effort to regulate the activity of digital lenders in the digital space in Kenya. This regulation establishes a licensing framework specific to digital lenders. The 2022 Regulations circumscribes the activities of digital credit providers to focus solely on providing credit and any other activity as duly authorized by the CBK from time to time. It follows that digital credit providers can no longer keep customer funds as they did previously (article 4(2)).
Chief among the provisions against illegal debt collection is art 20 of the 2022 Regulations which prohibits digital credit providers, their officers, employees or agents in the course of debt collection from engaging in any of the following conduct against the customer or any other person— use of threat, or violence or other criminal means to physically harm the person, or his reputation or property, use of obscene or profane language, make unauthorized or unsolicited calls or messages to a customer’s contacts, improper or unconscionable debt collection tactic, method or conduct and any other conduct whose consequence is to harass, oppress, or abuse any person in connection with the collection of a debt.
The 2022 Regulations were replaced by the NDTCP Regulations of 2026 which reinforces the protections under the Act at several levels. First, the NDTCP reproduces the prohibitions on illegal debt collection practices in article 20 of the Act and adds other illegal debt collection methods such as lenders calling borrowers or any person outside working hours, collect or repossess physical security using violence, take away essential personal effects of a borrower in the course of collecting, repossessing or realizing security; or any other conduct which goes against the laid out procedures in Auctioneers Act and the relevant rules thereunder. It further forbids lenders from recovering any charges not disclosed to the borrower and provides a mechanism for refunds when the lender collects more than what was due under the loan contract. Outsourcing of debt collection to third parties is also permitted under the NDTCP provided the borrower is informed before commencement. The NDTCP further provides conditions for the deployment of artificial intelligence by lenders. This regulatory intervention aims to put an end to predatory debt collection practices which had lingered over the years.
Away from illegal debt collection measures, the NDTCP introduced provisions obliging digital credit providers to keep transaction receipts , set up customer complaint mechanisms based on defined standards, develop a robust security system, guarantee customer information against regulatory benchmarks, clear terms and conditions of service, prohibition of false advertisements against regulatory standards, and variation of credit terms based on regulatory requirements, among others. This string of legal authorities came in handy to respond to the challenges facing digital credit services in Kenya.
Under the licensing framework introduced in 2022, the courts in recent decisions, have adopted the position that unlicensed digital lenders cannot recover their debts from borrowers through the courts as it will constitute an illegality and economic risk (see Tri-State Capital Limited v Kang’ethe (Claim E102800 of 2025) [2026] SCC 161 (KLR) (17 July 2026) (Judgment and Mombo Icapital Ltd v Kariuki (Claim E103968 of 2025) [2026] SCC 168 (KLR) (17 July 2026) (Judgment). The court further stated in both judgments that “A party who undertakes regulated financial activities without the requisite authorization cannot invoke the aid of the Court to enforce rights arising from such unlawful activities”. It emerges from the afore cited cases that private-law remedies can play an effective role in complementing regulatory enforcement in the long run, given the stiff stance of the courts in applying debt collection practices involving non-licensed entities.
Given that digital credit providers span several industries and require a comprehensive and holistic approach to consumer protection, a draft Financial Consumer Protection Framework for Kenya was released by CBK for public consultation. This Framework provides a comprehensive and harmonised approach to consumer protection and market conduct supervision across the financial services sector.
The Draft Financial Consumer Protection Framework for Kenya (the FCPF)
The Financial Consumer Protection Framework (FCPF) Draft is timely because expanded access to financial services (including digital lending) has enabled previously underserved and vulnerable populations, including women, youth, low-income households, and rural communities, to participate in the formal financial economy (Governor, Central Bank of Kenya, 2026). Consumers increasingly face emerging threats, including fraud, phishing attacks, misuse of personal data, non-transparent fees, predatory lending practices, and rising levels of over-indebtedness (Ibid).
Unlike the NDTCP, which is a Regulation by the CBK, the FCPF is the product of a Joint Financial Sector Regulators Forum comprising the Capital Markets Authority, the Central Bank of Kenya, the Insurance Regulatory Authority, the Retirement Benefits Authority, the Sacco Societies Regulatory Authority, the Communications Authority of Kenya, and the Competition Authority of Kenya.
The FCPF is anchored on financial consumer protection principles, to wit: fair treatment and responsible conduct, disclosure and transparency, product design and suitability, fund and asset protection, and complaint resolution, including debt collection.
Also, the FCPF introduces the concept of “vulnerable consumer” under Kenya's consumer protection landscape, defined as “a consumer who, due to their personal circumstances, is especially susceptible to harm in connection with their acquisition or use of a financial product or service. A consumer’s vulnerability may be temporary or longer-term and may arise from, for example, any combination of health conditions, life events, ability to withstand financial or emotional shocks and level of knowledge and skills”.
From a debt collection perspective, a FSP or its representative shall not use physical force, coercion, undue influence, pressure, duress or harassment, unfair tactics or any other similar conduct in connection with demanding or collecting any amount due by a retail consumer in relation to any financial product or service under the draft. These forbidden tactics have not been defined and are left to the appreciation of the regulators and the courts. The FCPF also forbids false and misleading statements concerning debt and over-indebtedness by obliging digital lenders to verify if borrowers can repay loans before issuance.
Also, an FSP cannot disclose to a third party that a person has an outstanding debt or threaten to disclose such information to a third party, except as expressly permitted by law, access or use a person’s phone, digital or other contacts, records or messages for the purposes of sending communications to third parties.
Furthermore, FSP cannot engage in any shaming of a person, such as disclosure of a debt or the debtor’s identity on a public social media channel or in a social media message sent to third parties, or an announcement or notice published via radio, newspaper or at a community forum or place of worship or other public premises. An FSP cannot also contact a retail consumer at any time, or with a particular frequency as prescribed by the relevant Regulator. Thus, the FCPF reinforces obligations of lenders in the NDTCP and introduces new duties to them.
Institutionally speaking, the draft FCPF proposes a common framework across all financial regulators to ensure effective enforcement of the laws and regulations on consumer protection. This holds true as the various financial regulators are expected to act under the regulatory perimeter that governs them. Now, all financial regulators must collaborate to ensure timely enforcement and enhanced supervisory follow-up. The core elements for credible enforcement are proposed by the FCPF, and the purpose of this approach is to beef up the effectiveness of the laws and regulations on abusive debt collection by creating synergy among the regulators.
Challenges that beset the prohibition of Illegal Debt Collection Practices in Kenya
It is noticeable from the foregoing analysis in points I and II above that Kenya's regulators have squarely addressed illicit debt collection through a binary perspective: the NDTCP and the FCPF (in the process of adoption). This reveals that digital lenders will henceforth be subject to overlapping regulatory protections to beef up consumer protection in this space. However, it is largely unclear how this approach and the current institutional framework is equipped to enforce these rules. Due to insufficient institutional capacity and enforcement challenges akin to those in the traditional financial sector, it is argued that such challenges will slip into the enforcement of debt collection in the digital lending space in Kenya.
This is telling from the Competition Authority of Kenya Annual Report and Financial Statements for the Financial Year ended 30th June, 2025, which state, among others, that complaints from the financial services sector accounted for over 61.6% of the consumer violations recorded in 2025. Digital lenders topped the chart at 355 complaints, compared with 67 in Financial Year 2023/2024. Practices duly prohibited in the Act, such as harassment, disclosure of loans to third parties, false advertisements, and loan disbursement issues, were further reported in 2025 – some being practised by licensed digital lenders. It is telling that consumer violations are on the rise in the digital lending space raising questions about the effectiveness of enforcement.
While this report is dated 30th June 2025, it should be noted that the entire legal framework governing the activities of digital lenders has been revisited in 2026. Thus, the question that lingers is if the NDTCP and the proposed FCPF provide the necessary regulatory levers to stall complaints in the digital lending space in Kenya.
This question crops up because it can be argued that the pressing issue in Kenya’s trajectory in curbing illegal debt collection should be tilted towards ensuring that existing laws work, rather than churning added layers of laws such as the NDTCP into an inefficient institutional framework.
This concern is particularly relevant since the NDTCP Regulations substantially reproduced the regulatory approach of their predecessor (the Act) although it remains uncertain whether the revised framework will overcome the enforcement weaknesses of the earlier regime. However, the extent of continuity between the two instruments, and whether the NDTCP introduces meaningful institutional or enforcement improvements, should be assessed through a detailed comparison of their provisions and implementation arrangements.
The FCPF may improve coordination by encouraging regulators to work within a common consumer-protection framework. Yet coordination alone will not necessarily resolve the challenges associated with insufficient staffing, limited technical resources, inadequate monitoring, and weak enforcement follow-up. Where regulators lack the personnel and resources required to supervise an expanding market, additional legal obligations may prove difficult to implement consistently.
The challenge, therefore, is not simply to determine whether Kenya has sufficient legal rules prohibiting abusive debt collection. It is also to examine whether the relevant institutions possess the authority, resources, technical capacity, and coordination mechanisms necessary to translate those rules into effective protection. Without these conditions, the regulatory framework risks creating a gap between the protections available in law and the remedies accessible to consumers in practice.
Conclusion
It can be harvested from the above analysis that the current regulatory and institutional mantle for the protection of consumers from illegal debt collection in Kenya is far from over. This is tenable as consumer complaints from illegal debt collection practices continue to rise despite regulatory inroads in the sector. Thus, the persistence of complaints about abusive debt collection raises questions about the relationship between regulatory expansion and effective enforcement.. This arises because despite the adoption of laws and regulations, the effectiveness of the laws and regulations still remains a troubling issue.
Ultimately, the challenge is not merely to enact more rules, but to ensure that existing protections are implemented, monitored, and enforced effectively. Without a corresponding improvement in institutional capacity and accountability, further regulatory expansion may fail to deliver the level of consumer protection that Kenya’s growing digital lending market requires.
It is recommended, in this regard, that consumer organisations should empower and educate consumers of their rights and that the enforcement capacity of government agencies overseeing consumer protection be beefed up.