Kenya

Legal Notice No. 116 of 2025, made under the Banking Act. Defines a violation as non-compliance with the Act, the Prudential Guidelines or a direction of the Central Bank and sets maximum penalties by breach, for example up to KES 20 million for continuing banking business after licence revocation (reg. 7) and up to KES 10 million for late submission of audited financial statements (reg. 55).

Issued under section 36C(1)(d) of POCAMLA for institutions licensed under the Banking Act, Microfinance Act, CBK Act and National Payment System Act, effective 1 September 2025. It states that Kenya's framework has no CDD thresholds or exemptions, requires CDD before an account is opened or a one-off transaction is done, and sets continuous monitoring and seven-year record keeping. The CBK also posted 2025 guidance on politically exposed persons and beneficial ownership.

Legal framework to license and regulate virtual asset service providers. Section 5 designates the CMA and the CBK as authorities and section 8(2) bars carrying on virtual asset business without a licence. The First Schedule gives the CBK wallet providers, payment processors and stablecoin issuance, and the CMA brokers, advisers, managers and token offerings; the Second Schedule makes VASPs reporting institutions under POCAMLA. Assented to 15 October 2025.

Made on 14 March 2022 and gazetted on 18 March 2022 under section 57 of the CBK Act. Requires a CBK licence for digital credit business (reg. 4), bars deposit-taking (reg. 8(2)), sets consumer protection rules on affordability checks, recovery limits and debt collection conduct (regs. 17-29) and customer data handling (regs. 13-15, 24, 26).

Procedure for complaints, enforcement notices and penalty notices under the Data Protection Act; the ODPC cites regulations 20 and 21 as the basis for its penalty notices. Legal Notice No. 264 of 2021. Regulation 20 provides for the penalty notice, including a daily fine of up to KES 10,000 per unrectified breach, and regulation 21 for its enforcement.

Issued under section 33(4) of the Banking Act for banking institutions. Requires boards to embed climate-related financial risk in governance, strategy and risk management, a board-approved implementation plan to the CBK by 30 June 2022, quarterly progress reports from 30 September 2022 and TCFD-benchmarked disclosure.

Made under section 93A of the Companies Act, 2015. Every company must identify its beneficial owners (natural persons with at least 10 percent of shares or voting rights, or the right to appoint or remove a director, or significant influence), record their particulars and lodge the register (Form BOF1) and changes (Form BOF2) with the Registrar. Kenya Law shows the Regulations as amended by Legal Notice 32 of 2022 and Legal Notice 162 of 2023.

Gives effect to Article 31(c) and (d) of the Constitution. Establishes the Office of the Data Protection Commissioner (s.5), requires registration of controllers and processors (s.18), sets processing principles (s.25) and data subject rights (s.26), and requires breach notification (s.43). Assented 8 November 2019.

Framework for limited-scale live testing of innovative capital markets products and services. Applicants must be companies limited by shares; testing runs for up to twelve months with one extension of up to twelve more; the application fee is KES 10,000 and the CMA responds within fourteen working days.

Issued under section 33(4) of the Banking Act to all institutions licensed under the Banking Act. Sets board governance duties, a CISO reporting line, third-party and outsourcing risk controls (section 3.3), notification to the CBK within 24 hours of a significant incident and quarterly incident reports.

Provides for the prevention, investigation and punishment of bribery. Section 9 requires public and private entities to put in place procedures to prevent bribery, section 14 imposes a duty to report to the Commission and section 21 protects whistle-blowers and witnesses. Assented 23 December 2016; amended by Act No. 19 of 2023.

Framework for responding to climate change. Section 16 lets the Climate Change Council and the Cabinet Secretary impose climate obligations and reporting on private entities and section 17 gives NEMA compliance monitoring powers. Amended by the Climate Change (Amendment) Act, 2023 (No. 9 of 2023).

Issued by the CMA under section 12A(1) of the Capital Markets Act and dated 15 December 2015. They apply to licensed or approved market intermediaries, including collective investment scheme managers, and require board-approved AML/CFT policies, risk-based due diligence, record keeping for at least seven years, reporting of suspicious and large cash transactions to the Financial Reporting Centre and staff training. The CMA also posts 2023 AML/CFT risk-based approach guidance and 2025 circulars on CDD, PEPs and beneficial ownership.

Sets authorisation, core capital (for example KES 20,000,000 for e-money issuers), trust account (reg. 25), agent (regs. 14-20), outsourcing (reg. 23) and reporting (reg. 29) requirements for payment service providers. Kenya Law shows the version revised to 31 December 2022.

Provides for the regulation and supervision of payment systems and payment service providers. Sections 12-15 require CBK authorisation of payment service providers, with 12-month authorisations that can be renewed or revoked; section 18 lets the CBK prohibit harmful payment instruments. Assented 2 December 2011 and commenced 24 March 2014; latest listed amendment is the VASP Act (Act No. 20 of 2025). The CBK has published a draft National Payment System Bill, 2026 for comment.

Kenya's main AML/CFT statute. It establishes the Financial Reporting Centre (s.21), defines reporting institutions to include financial institutions, DNFBPs and virtual asset service providers, and sets duties on customer identification (s.45), suspicious transaction reporting (s.44), record keeping (s.46), internal controls (s.47) and registration with the Centre (s.47A). Section 24B lets the Centre impose monetary penalties of up to KES 25 million on a body corporate.

Law under which SASRA licenses and supervises deposit-taking SACCOs and oversees other SACCOs. The SASRA site lists the Act and its regulations under Acts & Regulations.

Sets employees' fundamental rights and minimum conditions of employment. Sections 35-51 cover termination notice, summary dismissal and unfair termination, section 46(h) bars dismissal for initiating a complaint or proceedings against the employer, and section 10(6) requires written particulars to be kept for five years after termination. Latest listed amendment is Act No. 3 of 2024.

Provides for the prevention, investigation and punishment of corruption, economic crime and related offences. Section 48 sets penalties of a fine up to KES 1 million, up to ten years' imprisonment, or both, plus a fine of twice the benefit or loss; section 65 protects persons who assist or give information to the Commission. Assented 30 April 2003; latest listed amendment is the Conflict of Interest Act (No. 11 of 2025).

Founding law of the Retirement Benefits Authority, which regulates and supervises retirement benefits schemes. The RBA website hosts the Act, the Retirement Benefits Regulations and its guidelines and practice notes.

Law that, in its long title, amends and consolidates the law regulating the business of banking in Kenya. Assented to 13 September 1989 and commenced 1 November 1989; Kenya Law lists the Business Laws (Amendment) Act, 2024 (Act No. 20 of 2024), effective 27 December 2024, as the latest amendment.

Establishes the Capital Markets Authority (s.5) to promote, regulate and facilitate an orderly, fair and efficient capital market. Section 11(3)(cc) and section 25A let the Authority impose sanctions, including public reprimand, financial penalties of up to KES 10 million on licensed persons and disqualification of directors; section 18(2A)-(2C) provides whistleblower rewards. Assented to 13 December 1989 and published 15 December 1989; Kenya Law notes outstanding amendments not yet applied, the latest being the Virtual Asset Service Providers Act (No. 20 of 2025).

Law to amend and consolidate the law relating to insurance and to regulate the business of insurance. Part II establishes the Insurance Regulatory Authority (s.3), section 19 bars unlicensed insurance business and section 41 requires a capital adequacy ratio of 100 percent. Assented to 8 January 1985 and commenced 1 January 1987; latest listed amendment is Act No. 18 of 2023.

Establishes the Central Bank of Kenya as a body corporate (s.3), sets price stability as its principal object (s.4) and lists its supervisory functions (s.4A), including authorised dealers, non-deposit-taking credit providers, credit guarantee companies, virtual asset service providers and mortgage refinance companies. The original Act dates from 1966; the CBK posts the text as at 4 November 2025.