A curated starting point for the Kenyan rules and official materials shaping payments, data protection, digital credit and financial-crime compliance.
Each entry links to a primary regulator or Kenya Law source and highlights a practical issue for management. It is not a complete statement of law or a substitute for advice.
The National Payment System Act and Regulations form the core Kenyan framework for payment systems and payment service providers.
Map the actual funds flow and service against the statutory perimeter before launch or structural change.
CBK’s published checklist identifies preliminary engagement and application materials for prospective payment service providers.
Treat authorisation as an evidence-and-operating-readiness project, not only a form-filing exercise.
Section 31 of the Data Protection Act requires a DPIA before processing likely to create high risk to individuals’ rights and freedoms.
Screen products early enough for risks and safeguards to influence design, procurement and contracts.
The Data Protection (General) Regulations identify processing operations associated with high risk, including certain automated decisions, biometrics, sensitive data, dataset matching and innovative technology.
Document the screening decision even where the conclusion is that a formal DPIA is not required.
ODPC guidance addresses risk assessment and safeguards where personal data is transferred outside Kenya.
Map hosting, remote access and subprocessors instead of assuming that the main vendor’s address identifies every transfer.
Kenya’s Financial Reporting Centre states that reporting institutions must comply with applicable AML/CFT measures under POCAMLA and the Regulations.
Confirm reporting-institution status and translate obligations into risk-based onboarding, monitoring, escalation, reporting and recordkeeping controls.
The 2022 Regulations provide for CBK licensing and oversight of digital credit providers within their scope.
Assess the complete credit model, customer journey, data use, pricing and collection arrangements before market entry.