The draft National Payment System Bill, 2026 would tighten licensing, require ring-fenced trust accounts for e-money and wallets, cap single‑bank exposure, expand CBK intervention powers and impose steep fines and criminal sanctions.
No single bank may hold more than KSh 500 million or 25% of a provider's trust funds, whichever is higher, to limit concentration risk.
The Bill introduces licensing and authorization requirements for payment system operators and service providers and gives CBK broad intervention powers including statutory management.
Penalties include fines up to KSh 20 million for breaches, escalating to KSh 30 million for repeat offences, daily fines up to KSh 100,000 and potential prison terms up to seven years for unlawful exploitation of payment systems.
# What the draft law would change Kenya (CBK) published the draft National Payment System Bill, 2026 to replace the National Payment System Act (Cap. 491A). The draft targets payment service providers, fintechs, electronic money issuers and digital wallet operators with new licensing, custody and consumer protection rules.
# Licensing and authorization The Bill would introduce a formal licensing framework for companies that operate payment systems or provide payment services. Banks, microfinance banks and building societies would not need a new CBK licence but must obtain formal authorization and meet equivalent capital adequacy standards. Other firms that process payments or operate payment systems would need to apply for CBK licences and meet prescribed standards.
# Custody of customer funds: ring‑fenced trust accounts
# Limiting concentration risk at banks
# Consumer protection and disclosure Payment providers would be required to give customers clear, timely information about products and services: fees, charges, limitations, risks and full terms and conditions. The draft raises consumer protection and data security expectations for how providers handle customer information.
# CBK supervisory and enforcement powers The Bill grants CBK strengthened intervention and enforcement powers, including statutory management and direct control measures when a provider is non‑compliant or financially distressed. The draft expands the regulator's toolkit to step into troubled payment systems.
# Penalties and criminal sanctions Monetary penalties in the draft are significant: up to KSh 20 million for breaches, rising to KSh 30 million for repeat offences. The Bill also contemplates daily penalties of up to KSh 100,000. Individuals who unlawfully exploit a payment system for personal financial gain could face criminal liability, including up to seven years in prison.
# Process for public input and next steps The Treasury and CBK invited stakeholders and the public to submit comments and memoranda on the draft Bill by Friday, October 9, 2026. CBK planned public participation forums across the country between September 28 and October 9 in towns including Mombasa, Kisii, Kitui, Kisumu, Nyeri, Kitale, Meru, Nandi, Garissa, Nakuru and Nairobi.
# Practical implications for providers and customers
# Where this fits in recent regulation The draft follows CBK's recent moves to license digital credit providers and tighten rules for financial institutions. The new Bill would consolidate and raise standards specifically for payment systems and digital payment services across the sector.
CBK has intensified its licensing drive to curb unregulated digital lenders accused of high costs, unethical debt collection and data misuse.
Kenya’s biggest banks could face tougher requirements and stricter oversight under new CBK rules aimed at guarding against financial shocks.
The Central Bank of Kenya (CBK) has licensed 29 more digital credit providers (DCPs), bringing the total number of regulated lenders in the sector to 281. In a September 30 press release, the regulator said the new approvals aim to ensure compliance with the law and safeguard the interests of customers using digital le
The authority has proposed a Ksh15,000 fee for commercial-use permits and a Ksh5,000 fee for non-commercial or personal-use permits.
The coexistence of European rules on data protection, artificial intelligence, cybersecurity and access to data has created regulatory overlaps and cumulative obligations for businesses. The Digital Omnibus package seeks to address this issue, although it...
Under the new framework, settlement terms will comprise a settlement amount, disgorgement of wrongful gains, where applicable, and remedial and regulatory terms (RRT). RRT was earlier referred to as non-monetary terms.
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.