Every regulator. One platform.

What they regulate

The CBK licenses and supervises commercial banks, microfinance banks, forex bureaus, payment service providers (PSPs), and Virtual Asset Service Providers (VASPs). It is the primary prudential and consumer protection regulator for Kenya's financial sector.

Typical compliance obligations

• Licensing and ongoing regulatory capital requirements
• Anti-Money Laundering (AML) and Know-Your-Customer (KYC) programmes
• Periodic reporting: monthly, quarterly, and annual statutory returns
• Consumer complaint handling and dispute resolution frameworks
• For VASPs: enhanced due diligence, transaction monitoring, travel rule compliance

Key instruments monitored

• Banking Act Cap 488 & CBK Act Cap 491
• National Payments Systems Act 2011
• CBK Prudential Guidelines
• CBK VASP Regulatory Framework 2025
• CBK Circulars (issued monthly)

Update frequency

High: circulars and guidance issued on average 2–3 times monthly.

What they regulate

The ODPC enforces Kenya's Data Protection Act 2019 (DPA). Any business that collects, processes, or stores personal data of Kenyan residents, regardless of where the business is incorporated, is subject to DPA obligations.

Typical compliance obligations

• Registration as a Data Controller or Data Processor with the ODPC
• Appointment of a Data Protection Officer (DPO) for high-risk processing
• Lawful basis for processing personal data (consent, legitimate interest, contract)
• Data Transfer Impact Assessments for cross-border transfers
• Breach notification to the ODPC within 72 hours of discovery
• Data localisation for categories of sensitive personal data

Key instruments monitored

• Data Protection Act 2019
• Data Protection (General) Regulations 2021
• Data Protection (Registration of Data Controllers and Processors) Regulations 2021
• ODPC Guidance Notes (issued periodically)

Update frequency

Medium: regulations are maturing with new guidance notes and enforcement decisions every quarter.

What they regulate

The CMA regulates Kenya's capital markets including stockbrokers, fund managers, collective investment schemes, and increasingly, virtual asset exchanges under its regulatory sandbox framework.

Typical compliance obligations

• Licensing: stockbroker, investment adviser, fund manager, REIT manager
• Prospectus approval for public offers of securities
• Continuous disclosure obligations for listed entities
• Regulatory sandbox applications for fintech and VASP models
• Compliance with CMA Market Conduct Rules and anti-market abuse provisions

Key instruments monitored

• Capital Markets Act Cap 485A
• Capital Markets (Securities) (Public Offers, Listing and Disclosures) Regulations
• Capital Markets (Regulatory Sandbox) Guidelines 2019
• CMA Digital Asset Exchange Guidance (2025)

Update frequency

Medium-High: active regulatory development, especially in crypto and digital assets space.

What they regulate

The KRA administers all national tax obligations including corporate income tax, VAT, withholding tax, and the Digital Service Tax that applies to non-resident digital platform operators.

Typical compliance obligations

• Annual corporate tax returns (30% standard rate for resident companies)
• Monthly VAT returns and remittance (standard rate 16%)
• Withholding Tax on payments to non-residents (dividends, royalties, services)
• Digital Services Tax (DST) for non-resident digital marketplace operators
• Transfer pricing documentation for related-party transactions
• Pay-As-You-Earn (PAYE) returns for employers

Key instruments monitored

• Income Tax Act Cap 470
• Value Added Tax Act 2013
• Tax Procedures Act 2015
• Digital Service Tax Regulations 2020
• Annual Finance Acts (most recently Finance Act 2025)

Update frequency

Medium: annual Finance Acts and periodic practice notes and ruling changes.

What they regulate

The CAK enforces Kenya's competition law including pre-merger notifications, investigations into anti-competitive conduct, and consumer protection standards across all sectors.

Typical compliance obligations

• Pre-merger notification for transactions meeting the notification threshold (KES 1bn combined turnover)
• Prohibition on anti-competitive agreements, price fixing, and market sharing
• Prohibition on abuse of dominant market position
• Consumer protection: misleading advertising, unfair contract terms
• Sector-specific market inquiries (the CAK may initiate at any time)

Key instruments monitored

• Competition Act 2010
• Merger Threshold Guidelines 2019
• Consumer Protection Act 2012
• CAK Sector Inquiries and Determinations

Update frequency

Low-Medium: major merger decisions and occasional guidelines or market inquiries.