Kenya’s central bank wants the power to make banks and payment providers hand customer data to licensed outside firms. The change would bring open banking to one of Africa’s largest digital payments markets.
The National Treasury and the Central Bank of Kenya (CBK) have published the draft National Payment System Policy and the National Payment System Bill, 2026. The Bill repeals the National Payment System Act, Cap. 491A, which dates from 2011. The Policy sets the aim: payments that work across providers, protect customers and reach more people. The Bill turns that aim into law on competition, consumer and data protection, and financial stability. Comments close on 9 October 2026.
What the Bill would require
Clause 29 obliges every payment service provider and payment system operator to run systems that can share customer data securely with third parties for open finance. Clause 29(2) lets CBK require a provider to switch on that sharing, but only after the customer consents. The Bill defines open finance as access, with the customer’s permission, to data a provider holds, so that outside firms can build new services.
Clause 28 adds a separate duty. Each provider must run systems that work with rival systems, and CBK can order interoperability arrangements.
Who gets access to customer data
Clause 29 does not name the third parties. The First Schedule does, through two new licence categories. Payment initiation service providers start payments on a customer’s behalf. Account information service providers pull data from several accounts into one view for the customer.
Clause 36 requires electronic money issuers and wallet providers to hold customer money in trust accounts at a bank or microfinance bank. The Bill applies no such rule to payment initiation or account information firms, so they can serve customers without holding funds.
That matters because of who holds the data today. M-PESA moved KES 41.7 trillion across 46.4 billion transactions in the year to March 2026. It earned KES 182.7 billion, or 45.6 per cent of Safaricom’s Kenya service revenue. The platform passed 40 million monthly active customers in March. Licensed fintechs could compete for those customers without owning the accounts. Rivals are also raising money: for example, Airtel Money is preparing a London listing at a valuation of up to $9 billion.
What the Bill leaves undecided
The Bill says little about how access would work. Regulations would set which data can be shared, on what conditions and at what cost. Clause 29(3) says CBK shall make those regulations. Clause 76 gives regulation-making power to the Cabinet Secretary on CBK’s recommendation. The two clauses need reconciling.
Clause 79 gives existing providers one year from commencement to comply, and CBK will issue guidance. Penalties are set. CBK can fine a firm up to KES 20 million and an officer up to KES 3 million, rising to KES 5 million for repeat offenders. Continuing breaches add up to KES 100,000 a day.
Fintechs have worked in a legal grey area for years. In 2022 CBK told banks to stop dealing with Flutterwave and Chipper Cash over missing licences. In 2024 Governor Kamau Thugge said CBK was rewriting the 2011 Act to give fintechs a legal framework, TechCabal reported.
The Policy points to open banking rules in the United Kingdom and the European Union as models. It commits the Government to mandate open API standards, build a national instant payment switch and set up a sandbox. It also notes that non-bank providers reach clearing and settlement systems only through banks.
A foundation, not yet a framework
Ali Hussein Kassim, Chairman of the Association of FinTechs in Kenya and Vice President Eastern Africa of the Africa FinTech Network, has given his view through his #AliTalksTech series. He says it is his own perspective, not an industry statement. His answer to whether this is Kenya’s open finance moment is “potentially yes.”
“Open finance is not institutions sharing data because they can,” Kassim says. “It is customers choosing, clearly, specifically and reversibly, who can access their data and initiate payments.”
He argues the Bill gives the legal foundation but not the operating model. The work sits in the rules around it: consent, accreditation, API standards, liability, redress, cybersecurity, access economics and inclusion. He wants consent that is granular, informed, auditable and easy to withdraw. He also wants redress where the first institution a customer contacts coordinates the fix, so customers do not have to trace a chain of providers themselves.
His six suggestions:
- Fix the drafting errors before enactment.
- Build standards before broad activation.
- Pilot before scaling.
- Put customers and underserved groups in the room.
- Keep mobile money at the centre of the design.
- Encourage evidence-based submissions from all market participants.
Capital rules raise the cost of entry
The Third Schedule sets minimum core capital by licence, from KES 5 million to KES 250 million, a 50 times gap.
| Licence | Type | Minimum capital (KES) | USD equivalent |
|---|---|---|---|
| Electronic money issuer | Provider | 250 million | $1.93 million |
| Merchant acquirer | Provider | 50 million | $386,100 |
| Electronic wallet provider | Provider | 50 million | $386,100 |
| Card scheme operator | Operator | 50 million | $386,100 |
| Switching and clearing operator | Operator | 50 million | $386,100 |
| Money remittance provider | Provider | 30 million | $231,700 |
| Payment messaging operator | Operator | 20 million | $154,500 |
| Payment gateway | Operator | 10 million | $77,200 |
| Payment initiation provider | Provider | 5 million | $38,600 |
| Account information provider | Provider | 5 million | $38,600 |
Dollar figures use KES 129.49 to the dollar, the CBK rate of 21 September 2026. Source: Third Schedule, National Payment System Bill, 2026.
A firm with more than one licence holds the full amount for its highest category plus 50 per cent of the amount for the additional category. An issuer that also runs a wallet would need KES 275 million ($2.12 million).
Borrowed money does not count
Clause 10 limits core capital to paid up ordinary share capital and disclosed reserves, less goodwill and intangible assets. Unpaid or contingent commitments, shareholder loans, funds raised through borrowing and revaluation reserves do not qualify. Founders who fund their firms with loans would need to restructure as equity, which weighs hardest on small firms.
Banks, sandbox and the road to 9 October
Banks, microfinance banks, building societies and listed government enterprises need CBK authorisation, not a full licence (clause 9). They must still meet the Third Schedule capital requirements.
Clause 74 lets CBK create a sandbox through regulations. Firms could test products on the payment system without a full licence. No sandbox exists yet.
Comments on the Bill and the Policy close on 9 October. Kassim’s deck lists the submission routes as email to paymentslawreview@centralbank.go.ke, post to the Governor of the Central Bank of Kenya, or hand delivery at Haile Selassie Avenue, Nairobi. Most of the substance will be settled later, in regulations, standards and pilots. The Bill sets the direction. Those rules will decide whether customer data moves on terms customers control.
