Digital Lending Agreement (Kenya)

A Digital Lending Agreement in Kenya records the obligations the parties accept and the terms governing their arrangement.

The Central Bank of Kenya introduced the Digital Credit Providers Regulations 2022 to regulate a sector that had previously operated in a legal vacuum, with hundreds of unregulated mobile lending applications operating in Kenya between 2016 and 2022. Before regulation, effective Annual Percentage Rates on mobile loans in Kenya frequently exceeded 200% per annum when flat fees and short repayment periods were annualised, and abusive debt collection practices — including accessing borrowers' phone contacts to shame defaulters — were widespread. Under the 2022 Regulations, all persons and entities offering digital credit products in Kenya must obtain a DCP licence from the CBK. Lending without a CBK DCP licence is an offence under Section 33B of the Central Bank of Kenya Act (Cap. 491).

A Digital Lending Agreement in Kenya differs materially from a conventional written loan agreement. The agreement must comply with the mandatory disclosure requirements of the Digital Credit Providers Regulations 2022, which require DCPs to disclose the Annual Percentage Rate — not merely a flat daily or weekly fee — the total cost of credit in Kenya Shillings (KES), all applicable fees and penalties, the data processing practices of the lender, and the borrower's rights before disbursement. Pre-disbursement disclosure must be provided through the same digital channel used for the loan application, and the borrower must affirmatively consent before funds are released.

The Consumer Protection Act No. 46 of 2012, administered by the Competition Authority of Kenya (CAK), prohibits unfair, deceptive, and unconscionable conduct by credit providers — including misleading fee disclosures, bait-and-switch pricing, and aggressive collection tactics that amount to harassment. The CAK has investigated several digital lenders operating in Kenya for violations of the Consumer Protection Act No. 46 of 2012.

Data protection is a central regulatory dimension of digital lending in Kenya. The Data Protection Act No. 24 of 2019, administered by the Office of the Data Protection Commissioner (ODPC), imposes strict obligations on DCPs regarding the lawful basis for processing borrowers' personal data — including mobile transaction history, airtime usage patterns, and location data that many DCPs use for algorithmic credit scoring. The ODPC has investigated multiple Kenyan digital lenders for unlawful access to borrowers' phone contacts and for publicly shaming defaulting borrowers — practices expressly prohibited under Section 25 of the Data Protection Act No. 24 of 2019 and the CBK's own consumer protection guidelines.

The Law of Contract Act (Cap. 23) governs the formation, enforceability, and interpretation of Digital Lending Agreements in Kenya. The Limitation of Actions Act (Cap. 22) provides a six-year limitation period for the recovery of loan debts from the date the cause of action accrued. Credit information on borrowers — including default listings — is shared with the Credit Reference Bureaus (CRBs) regulated by the CBK under the Credit Reference Bureau Regulations 2020. The three licensed CRBs in Kenya are Metropol Corporation Ltd, TransUnion Kenya Ltd, and Creditinfo Kenya Ltd.

A Kenya Digital Lending Agreement is required whenever a CBK-licensed Digital Credit Provider disburses a loan through a digital channel to a borrower and needs to document the loan terms in a written agreement compliant with the CBK Digital Credit Providers Regulations 2022.

A Digital Lending Agreement is required when a CBK-licensed DCP disburses a consumer loan via M-Pesa (operated by Safaricom PLC under a separate CBK mobile money licence) or Airtel Money and needs to provide the borrower with a compliant written record of the terms before disbursement, as required by the Digital Credit Providers Regulations 2022. The CBK requires the agreement to be accessible to the borrower through the lending platform and retained in the DCP's records.

A Digital Lending Agreement is needed when a fintech company registered with the Business Registration Service (BRS) and licensed by the CBK as a DCP launches a new mobile lending product and needs a standardised agreement template that satisfies the CBK's mandatory disclosure requirements — including APR, total cost of credit, fees, penalties, data processing practices, and CRB listing consequences.

A Digital Lending Agreement is required when a SACCO regulated by the SACCO Societies Regulatory Authority (SASRA) or a microfinance institution licensed by the CBK under the Microfinance Act No. 19 of 2006 offers a digital loan product to its members or clients through a mobile application, and needs documentation meeting both CBK and SASRA compliance requirements applicable to digital credit channels.

A Digital Lending Agreement is needed when a borrower wishes to have a clear written record of their rights and obligations under a mobile loan before accepting disbursement — in particular, the right to a pre-disbursement disclosure statement showing the APR, the total repayment amount, the consequences of default including Credit Reference Bureau listing under the Credit Reference Bureau Regulations 2020, and the borrower's data rights under the Data Protection Act No. 24 of 2019.

A Digital Lending Agreement is required when a dispute arises between a borrower and a DCP over undisclosed fees, unauthorised data access, incorrect CRB listing, or aggressive collection conduct, and the parties need a written agreement to determine what terms were contractually agreed. The agreement serves as primary documentary evidence before the High Court of Kenya (Commercial Division), the Consumer Protection Department of the Competition Authority of Kenya, or the Office of the Data Protection Commissioner.

Under the Central Bank of Kenya Act (Cap. 491), the Central Bank of Kenya (CBK) regulates banking. The Capital Markets Authority (CMA) regulates securities under the Capital Markets Act (Cap. 485A). Section 84 of the Bills of Exchange Act (Cap. 27) governs promissory notes. The Kenya Revenue Authority (KRA) administers tax obligations. The Microfinance Act No. 19 of 2006 regulates microfinance institutions. The Hire Purchase Act (Cap. 507) governs credit sale agreements.

A Kenya Digital Lending Agreement compliant with the CBK Digital Credit Providers Regulations 2022 and the Data Protection Act No. 24 of 2019 must include the following essential provisions to be enforceable and regulatory-compliant.

Lender's Identity and CBK Licence Details: Full legal name of the Digital Credit Provider, BRS registration number, CBK DCP licence number and expiry date, registered office address in Kenya, and the CBK Consumer Complaints Desk contact details. Disclosure of the CBK licence number is a mandatory regulatory requirement under the Digital Credit Providers Regulations 2022 — agreements that omit it are non-compliant and may be challenged by the borrower.

Borrower's Identity: Full legal name, National Identity Card (NIC) number or passport number, KRA PIN, registered mobile number (the primary channel for disbursement and repayment notifications), and current residential address. The KRA PIN is required where the loan amount triggers withholding tax reporting obligations under the Income Tax Act (Cap. 470).

Loan Amount and Disbursement Channel: Principal loan amount in Kenya Shillings (KES), the digital channel through which the loan will be disbursed — M-Pesa, Airtel Money, or other CBK-registered electronic payment channel — and the anticipated disbursement date.

Interest Rate and Annual Percentage Rate: The interest rate expressed as both a periodic rate and an Annual Percentage Rate (APR) inclusive of all fees and charges, as required by the CBK Digital Credit Providers Regulations 2022. The APR must reflect the true cost of credit — not merely the nominal interest component. The total cost of credit in KES (principal plus all interest and fees) must be stated before disbursement.

Fees and Charges Schedule: An itemised list of all fees — origination fees, processing fees, platform fees, insurance premiums, and late payment penalties. Under the Consumer Protection Act No. 46 of 2012 administered by the Competition Authority of Kenya, any fee not disclosed in the agreement prior to disbursement is unenforceable against the borrower.

Repayment Schedule: The repayment amount, frequency (daily, weekly, or monthly), due dates, and method — typically via M-Pesa Paybill, automatic debit from the borrower's mobile money wallet, or bank account debit. Rights to early repayment without penalty must be addressed as required by the CBK consumer protection framework.

Default and CRB Listing: A clear statement of the consequences of default — accrual of late payment charges, right of the DCP to recall the full outstanding balance, and the obligation to report the default to one or more of the Credit Reference Bureaus (Metropol Corporation Ltd, TransUnion Kenya Ltd, or Creditinfo Kenya Ltd) under the Credit Reference Bureau Regulations 2020. The advance notice period before CRB listing — typically 30 days — must be specified.

Data Processing Clause: A dedicated data processing section specifying what personal data the DCP collects, the lawful basis for processing under Sections 30 and 31 of the Data Protection Act No. 24 of 2019, the specific purpose of processing (credit scoring, loan management, regulatory reporting to the CBK), data retention periods, and the borrower's rights — including the right of access, rectification, erasure, and complaint to the Office of the Data Protection Commissioner (ODPC). The forms-legal.com Digital Lending Agreement template includes a CBK and ODPC-aligned data processing clause.

Governing Law and Dispute Resolution: Kenya law shall govern the agreement, with disputes referred to the High Court of Kenya (Commercial Division) or the Consumer Protection Department of the Competition Authority of Kenya for consumer-law complaints.

Under the Central Bank of Kenya Act (Cap. 491), the Central Bank of Kenya (CBK) regulates banking. The Capital Markets Authority (CMA) regulates securities under the Capital Markets Act (Cap. 485A). Section 84 of the Bills of Exchange Act (Cap. 27) governs promissory notes. The Kenya Revenue Authority (KRA) administers tax obligations. The Microfinance Act No. 19 of 2006 regulates microfinance institutions. The Hire Purchase Act (Cap. 507) governs credit sale agreements.