Consultation review · 22 September 2026 · Draft proposals, not enacted law. The National Treasury and Central Bank of Kenya (CBK) have opened public participation on the draft National Payment System Policy and National Payment System Bill, 2026. Written comments are due on or before Friday, 9 October 2026. The announcement was published on 21 September; the policy document itself is dated August 2026.
For payment businesses, the useful response is a documented assessment of the proposed framework against the actual operating model. Who initiates the payment? Who holds the funds? Who supplies the gateway, wallet, messaging or clearing infrastructure? Which entity contracts with the customer, and which entity would need approval?
This review examines selected provisions of the official draft and their practical implications for founders, boards, legal and compliance teams, investors and technology partners. References to obligations below describe what the draft proposes. The business actions are our analysis and preparation recommendations, not a claim that the proposals already apply.
1. Keep the Bill, policy and current position separate
The official consultation announcement says the Bill is intended to replace the National Payment System Act, Cap. 491A. Publication for consultation does not itself repeal that Act or replace existing authorisations. Businesses should continue meeting their existing legal and licence requirements while evaluating the proposals.
The two consultation documents perform different functions. The policy sets a direction for infrastructure, interoperability, inclusion, risk management and consumer protection. The Bill proposes a statutory framework, with further detail left to regulations, guidance and regulatory decisions. A policy commitment to develop standards is not a presently effective technical standard.
Chapter 3 of the draft policy envisages, among other measures, open API and messaging standards, a national instant payment switch, digital public infrastructure, operational-resilience arrangements and stronger complaints and data-governance mechanisms. Firms can assess dependencies now without assuming that implementation dates, interfaces or participation terms have been settled.
2. Map the activity before selecting a licence
Clause 4 of the draft Bill sets a broad perimeter. It includes payment processing and storage, electronic money, payment messaging, initiation and account-information services, cross-border and remittance systems, certain payment-data activities and ancillary services. It also refers to virtual-asset service providers licensed to provide payment services under the VASP framework.
That breadth deserves careful consultation. Being mentioned within the Bill's application provision does not, by itself, resolve which approval a particular ancillary supplier needs. The definitions, licensing clauses, schedules, exemptions and intended implementing rules need to be read together. Neither a software label nor an assertion that the business never holds funds is a complete perimeter analysis.
Clauses 5 and 6 distinguish payment service providers (PSPs) from payment system operators (PSOs). The First Schedule places payment initiation, account information, merchant acquisition, electronic wallets, remittance and electronic-money issuance in the PSP group. It places gateways, payment messaging, card schemes, and switching and clearing in the PSO group.
Practical implication: prepare an entity-by-entity map showing each service, customer agreement, payment instruction, funds flow, settlement account and outsourced dependency. For a platform offering several services, identify every potentially relevant category rather than choosing the cheapest category first.
Clause 9 needs particular care. It would exempt specified entities—including banks and microfinance banks—from applying for a licence, but would still require an application for CBK authorisation, compliance with the legislation and the scheduled capital requirements. It should not be described as a blanket exemption for banks.
3. Capital is a business-model question
The Third Schedule contains the following proposed minimum amounts. These are draft capital requirements, not current application fees or a quotation for obtaining regulatory approval.
| Proposed category | Type | Draft minimum capital |
|---|---|---|
| Payment Initiation Service Provider | PSP | KES 5 million |
| Account Information Service Provider | PSP | KES 5 million |
| Money Remittance Service Provider | PSP | KES 30 million |
| Merchant Acquirer | PSP | KES 50 million |
| Electronic Wallet Provider | PSP | KES 50 million |
| Electronic Money Issuer | PSP | KES 250 million |
| Payment Gateway | PSO | KES 10 million |
| Payment Messaging System Operator | PSO | KES 20 million |
| Card Scheme Operator | PSO | KES 50 million |
| Payment Switching and Clearing System Operator | PSO | KES 50 million |
Clause 10 goes beyond the headline amounts. It proposes ongoing maintenance of minimum core capital and defines the components of that capital. Shareholder loans, unpaid commitments and capital raised through borrowed funds would not count as paid-up capital under the stated exclusions. An investment promise should therefore not be treated as already available regulatory capital.
For more than one licence category, clause 10(6) proposes the highest category's minimum plus 50% of the prescribed minimum for the additional category. As a simple two-category illustration, a merchant-acquiring category at KES 50 million plus a payment-initiation category at KES 5 million would produce KES 52.5 million under that formula. This is a draft-based illustration, not a determination that a particular firm needs those categories. The treatment of several additional categories merits express clarification.
Management action: model capital by actual activity; distinguish eligible capital from working capital and customer funds; and identify the effect on funding rounds, group structures and product sequencing. Any consultation argument about proportionality is stronger when supported by the service's risk and a realistic cost model.
4. Interoperability and open finance would affect both technology and contracts
Clause 28 proposes interoperable systems for PSPs and PSOs. It also addresses CBK approval for interoperability arrangements and powers to require an arrangement. This is relevant to access, integration, settlement responsibilities and participation agreements—not merely an API upgrade.
Clause 29 proposes systems capable of securely sharing customer data for open finance. It contemplates CBK requiring a sharing mechanism after customer consent and further regulations. That is not permission to share all customer information immediately or to treat consent as resolving every privacy and security issue.
A useful review would map authentication, consent capture and withdrawal, permitted uses, access control, data quality, fraud allocation, outage handling and responsibility when one participant's failure affects another. Commercial comments could address proportionate implementation, shared standards, liability allocation and the cost of participation. These are issues for consideration, not assertions that the Bill already prescribes every control.
5. Outsourcing needs an inventory, not just a vendor clause
Clause 30 proposes prior written CBK approval when a PSP or PSO intends to outsource operational functions. The clause defines an operational function by the consequences of defective performance: effects on continuing compliance, financial performance, or the soundness or continuity of payment services. It would prohibit arrangements that impair internal control or CBK's ability to monitor compliance.
The definition of outsourcing in clause 2 includes continuing arrangements with affiliated companies as well as external suppliers. A group technology centre should therefore be considered alongside external cloud, processing and support arrangements when assessing the draft.
Preparation: identify the function, supplier, entity receiving the service, locations, subcontractors, approval history and failure consequences. Then review audit and access rights, incident escalation, service levels, business continuity, change control and exit assistance. A contract can support oversight only if the business has the operational evidence to use it.
A focused consultation question is how the approval requirement should work for existing contracts, intra-group services and changes to an already approved arrangement. Firms should explain the operational problem and propose workable wording or implementation guidance.
6. Customer protection and safeguarding are operational matters
Clause 27 proposes clear product information, transparent terms and charges, suitability to intended users, protection of customer funds and data, and effective complaints handling. Clause 36 would require electronic-money issuers and electronic-wallet providers to hold customers' monies in trust accounts. Clauses 37–40 address separation and protection of those funds, insolvency and income from the accounts.
The Fourth Schedule proposes a single-bank concentration limit expressed as KES 500 million or 25% of monies in a trust account, whichever is higher. That wording should be read exactly; it is not a flat KES 500 million ceiling or a universal 25% ceiling.
Businesses should reconcile the product promise with the actual safeguarding and settlement arrangements. Useful evidence includes account mandates, trust documentation, reconciliation reports, exceptions, customer disclosures and responsibility for refunds and complaints. Do not assume a partner's contract resolves every obligation of the customer-facing entity.
7. Incident escalation, audits and payment data deserve early attention
Clause 33 proposes notifying CBK immediately after a material event significantly affecting business and operations. The listed events include material data breaches or cyber incidents, serious outages, critical third-party failures and specified financial, litigation and ownership events. The draft should not be paraphrased as a universal fixed-hour deadline for every incident.
Clauses 34 and 35 propose annual financial statements and system-audit reports within three months of the financial year-end, with the relevant auditors approved by CBK. The draft uses a 31 December financial year-end. A practical review should identify evidence owners, auditor requirements and dependencies rather than simply adding dates to a calendar.
Part X addresses payment transparency and traceability. Clause 48 specifies originator and beneficiary information and continuity of information through the payment chain. Clauses 49–53 address cross-border payments, intermediary and beneficiary PSPs, retention and standards. These proposals call for a joint review by compliance, payments operations and technology teams.
The drafting itself warrants comments: for example, clause 49(1) refers to information under clause 47(2) and (3), while clause 47 is the interpretation provision and the substantive information requirements appear in clause 48. A submission can flag that apparent cross-reference problem rather than silently rewriting the draft. Businesses should also explain practical handling of missing information, message-field limitations and cross-border dependencies.
8. Governance, investment and transition cannot be left until the end
Clause 11 and the Second Schedule propose fit-and-proper assessment for directors, significant shareholders, senior officers and trustees. Clauses 57 and 58 address prior CBK approval for mergers, acquisitions and significant ownership changes; clause 58 uses an incoming holding of at least 10%, directly or indirectly, for its stated test.
For founders and investors, this suggests a review of cap tables, beneficial ownership, conditions precedent, regulatory cooperation and completion timing. An investment agreement should not promise a regulatory outcome that neither party controls.
Clause 79 proposes compliance within one year of commencement for persons providing payment services and contemplates CBK guidance. That proposed year has not started merely because the consultation was published. It should not be converted into a September 2027 compliance date. The treatment of existing approvals, pending applications and PSO activities should be tested against the final legislation and transition guidance.
9. Turn the consultation into a useful management exercise
We recommend a short, evidence-led sequence:
- Map exposure: identify the legal entity, current permissions, services, funds flow, customer contracts and critical providers.
- Build an impact register: record the draft clause, current operating position, proposed effect, evidence, owner and unresolved question. Keep existing obligations separate from draft proposals.
- Prioritise decisions: isolate the issues affecting capital, product design, licensing, customer funds, contracts or delivery dependencies.
- Prepare comments: state the exact provision, the real operational issue, the proposed replacement wording and the reason for it.
- Obtain internal approval: confirm that the institution approves the submission and that confidential or personal information is handled appropriately before filing.
The official Bill template asks for the clause and subclause, existing wording, proposed revision and rationale. The policy has its own template for section-level comments, recommendations and proposed wording. Use the relevant template rather than sending a generic expression of concern.
10. Deadline and participation routes
The official public notice directs written comments to the Governor, CBK, by email at paymentslawreview@centralbank.go.ke, by post to P.O. Box 60000-00200, Nairobi, or by hand delivery to the Governor's office on Haile Selassie Avenue, Nairobi, on or before 9 October 2026, using the provided template.
Public forums are scheduled between 28 September and 9 October, from 9:00 a.m. to 1:00 p.m. The Nairobi forum is listed for 9 October at the Kenya School of Government, covering Nairobi, Kiambu and Kajiado. Consult the notice for the full county and venue schedule and check official updates before travelling. The forum schedule does not extend the written-comments deadline.
Request a business-specific NPS impact review
Is your organisation operating a wallet, gateway, remittance service, merchant-acquiring platform, payment infrastructure or bank partnership in Kenya? Request an NPS Bill impact and consultation review from S.N. Nyaga & Company Advocates.
Start with your entity name, the service you provide, current regulatory status and the decision you need to make. We can discuss a defined scope covering activity classification, a clause-linked impact matrix, contract and evidence gaps, and preparation of consultation comments. Scope, fees, availability and any submission authority must be agreed separately. Please do not send customer records or confidential contracts through a public comment or initial enquiry.
For continuing work, see our Bank and PSP Partner Readiness and Managed Contract Desk services.
Official documents
- CBK consultation announcement, published 21 September 2026
- Draft National Payment System Bill, 2026 — clauses and schedules cited above
- Draft National Payment System Policy, August 2026 — Chapter 3, sections 3.1–3.5
- Official Bill comments template
- Official policy comments template
General information based on the official consultation documents reviewed on 22 September 2026. This is a selected commercial and regulatory review, not an exhaustive legal opinion or advice on a specific business. The drafts may change. No enactment, commencement, licence outcome or engagement is represented by this publication.