Regulatory Compliance and Fintech
Expert Legal Representation.
About the Practice
We make the complex simple. Kenyan businesses now answer to more regulators, more often, than at any point in the country's history, and the rules move quickly. Our job is to tell you which rules apply, what the regulator expects, how to get and keep your licence, and what to do on the morning an inspection or an inquiry arrives.
We advise across financial services, payments, insurance, healthcare, telecommunications and technology on the Central Bank of Kenya, the Capital Markets Authority, the Insurance Regulatory Authority, the Office of the Data Protection Commissioner, the Competition Authority and the Financial Reporting Centre. Licence applications, regulatory audits and red flag reports, anti money laundering programmes, data protection registration and compliance, beneficial ownership and the contact person requirement, and internal policies a regulator will accept are our daily work.
Fintech keeps this practice busiest. We have taken foreign fintech companies into Kenya, advised payment service providers, digital lenders and intermediary platforms, and we are guiding businesses through the Virtual Asset Service Providers Act 2025 and its 2026 regulations, including the line between the Central Bank's territory and the Authority's. Our clients run their businesses. We carry the regulatory weight.
Select Experience
Advised a United States based fintech company on setting up in Kenya, including the legal and regulatory licences, permits and approvals required
Conducted a regulatory audit of a fintech company's operations and delivered a red flag report to meet a prospective lender's requirements
Undertook due diligence on a fintech company on behalf of a lender and advised on the transaction documents
Advised a fintech company on the issuance of a series of commercial papers in Kenya
Successfully processed an intermediary service platform provider licence before the Capital Markets Authority and now advising further platform operators
Prepared the data protection compliance framework for a delivery platform, including its privacy policy, controller and processor allocation, location tracking of riders and record retention
Advised a leading regional IT company on data processing agreements and service level commitments with commercial banks and a central bank
Undertook a baseline study on Kenya's compliance with the East African Community Common Market Protocol for an international development agency
Advising businesses on the transition to licensing under the Virtual Asset Service Providers Act 2025 ahead of the November 2026 deadline
Frequently Asked Questions
Does my business need to register with the Data Protection Commissioner?
+
Every data controller and processor must comply with the Data Protection Act 2019, and those above the thresholds in the registration regulations, measured by turnover, staff numbers and the nature of the processing, must register with the Office of the Data Protection Commissioner and renew the registration. We assess whether registration applies, complete it and prepare the privacy policy and internal records the Act expects.
What licence does a fintech need to operate in Kenya?
+
It depends entirely on the activity. Payments and wallets need a payment service provider authorisation from the Central Bank, digital lending needs a digital credit provider licence from the Central Bank, investment distribution needs a Capital Markets Authority licence and virtual asset activity now needs a licence under the Virtual Asset Service Providers Act 2025. Many businesses need more than one, and we map the licences before the product launches.
When is the deadline for virtual asset service providers to be licensed?
+
The Virtual Asset Service Providers Act 2025 commenced in November 2025 with a twelve month transition, so existing operators must be licensed by November 2026 under the regulations gazetted in July 2026. Applications go to the Central Bank of Kenya or the Capital Markets Authority depending on the activity, and the pack is substantial, so operators should be filing now.
What are my anti money laundering obligations?
+
Reporting institutions under the Proceeds of Crime and Anti Money Laundering Act, which include banks, fund managers, payment providers, insurers, advocates in certain transactions and real estate agents, must register with the Financial Reporting Centre, verify their customers, keep records, appoint a compliance officer and report suspicious and large cash transactions. We design and audit the programme to the standard the regulators and the Centre inspect against.
What is the contact person requirement?
+
Since 2023, a company without a company secretary must register a natural person resident in Kenya as its contact person with the Registrar of Companies under section 243A of the Companies Act, to be the point of contact for the regulator on beneficial ownership and related compliance. Failure attracts a fine and a daily penalty for each day of default, and foreign owned companies are the ones most often caught out.
Need Legal Assistance?
Contact our Regulatory Compliance and Fintech team today for expert guidance and representation.
Contact Us