Becoming a licensed Payment Service Provider in Kenya

Becoming a licensed Payment Service Provider in Kenya

The Central Bank of Kenya (CBK) oversees all payment service providers under the National Payment System (NPS) Act, 2011 and the NPS Regulations, 2014.

1. Understanding the CBK PSP Licence

If your business processes retail electronic payments, issues wallets, or operates as a payment gateway or aggregator, you must obtain authorisation from the CBK.

Common licence categories include:

• Electronic Retail Payment Service Provider (ERPS) – aggregators and processors.

• E-Money Issuer (EMI) – companies offering wallets or stored-value services.

Operating without CBK approval is a criminal offence.

2. Licensing Process and Timelines

Step 1: Concept and Name Clearance
Submit a concept note and three proposed names to the CBK’s Payment Services Division. Approval is typically valid for 12 months.

Step 2: Pre-Filing Meeting
CBK discusses your business model, capital plan, risk, and governance structure. It’s very crucial to hire experts to develop proper documents.

Step 3: Application Submission
File Form 1 (NPS Regulations), pay KES 5,000, and attach governance, financial, AML, and IT documentation.

Step 4: CBK Review
Expect follow-up queries within 30 days on AML, security, and settlement.

Step 5: Approval and Gazette Notice
Approved licences are gazetted. The end-to-end process takes 12–18 months for complete applications. The Central Bank of Kenya makes the decision to issue licences. An application for a licence may be approved or rejected.

3. Required Documents Checklist

4. Compliance Calendar

5. AML/CFT and KYC Duties

Under POCAMLA, PSPs are reporting institutions. They must:

• Conduct Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD).

• Report suspicious transactions to the Financial Reporting Centre (FRC).

• Keep AML and KYC records for at least seven years.

• Train staff and perform annual risk reviews.

6. Data Protection Obligations

The Data Protection Act, 2019 requires PSPs to:

• Register with the Office of the Data Protection Commissioner (ODPC).

• Maintain a Record of Processing Activities (RoPA).

• Conduct Data Protection Impact Assessments (DPIAs).

• Report breaches within 72 hours.

• Protect user data with encryption and secure access controls.

7. Consumer Protection

CBK demands transparency and fairness in all customer dealings. PSPs must:

• Clearly disclose fees and terms.

• Maintain a complaints-handling system resolving issues within 7 business days.

• Report unresolved cases to the CBK Ombudsman.

• Provide regular customer-service training.

8. Implementation Roadmap (6-Month Launch Plan)

• CEO: Regulatory liaison and strategy lead.

• Compliance Officer (MLRO): Oversees AML/CFT and FRC reporting.

• Data Protection Officer (DPO): Privacy governance and ODPC filings.

• Finance Officer: Capital adequacy and reporting.

• IT & Security Lead: Cyber-security and incident response.