National Payment System Bill 2026: CBK Data Sharing Mandate, Open Banking Rules, Ksh 30M Penalties

Business
Festus Chuma
October 7, 2026
0

CBK

Kenya is preparing for a major overhaul of the legal framework governing digital payments after the National Treasury and the Central Bank of Kenya (CBK) published the Draft National Payment System Bill, 2026.

The proposed legislation seeks to replace the existing National Payment System Act, creating a broader framework for payment service providers, payment system operators, digital finance, open finance, interoperability, consumer protection and regulatory oversight.

The Central Bank of Kenya says the proposed law is intended to promote a safe, secure, efficient, affordable, accessible and inclusive national payment system while encouraging innovation, competition and financial inclusion.

The draft is still a proposal. It has been released for public participation, meaning its provisions can still change before Parliament considers and potentially enacts it.

PAY ATTENTION: Follow Kenya Frontline WhatsApp channel for more news

The public-comment deadline is October 9, 2026, according to the official CBK public notice.

Among the most consequential proposals are new licensing categories, open-finance data sharing, tougher supervisory powers and penalties that could reach KSh30 million for repeat corporate offences.

Open banking moves closer to Kenya’s payment rules

One of the most significant provisions is the proposed open finance framework.

Clause 29 of the Bill would require every payment service provider or payment system operator to use systems capable of securely sharing customer data with third parties for open-finance purposes.

The provision is not an unrestricted data-sharing mandate.

The draft defines open finance as access by a third party to a customer’s data held by a payment service provider or payment system operator with the customer’s permission, for purposes including providing new or enhanced services and developing new business models.

Under the proposed open-finance rules, the CBK could require a payment provider to implement a secure mechanism for sharing customer data with third parties after obtaining customer consent. The Bill also says the Central Bank would make regulations giving effect to the provision.

That could significantly alter how Kenyan consumers interact with banks, mobile-money services and emerging financial-technology platforms.

A customer could, for example, authorise an approved third-party service to access relevant payment-account information without manually providing records from different financial institutions.

The commercial objective is to make financial data more portable while encouraging competition and innovation.

The regulatory challenge will be protecting consumers against unauthorised access, misuse of information and cyber threats.

The Bill already requires payment service providers and operators to protect customer data from loss, unauthorised use or unauthorised disclosure.

Customer consent becomes central

The proposed framework makes customer consent a critical safeguard.

The CBK would not simply receive a blanket power to allow companies to access everybody’s payment information.

Instead, the Bill links third-party access to the customer’s permission.

This is particularly important in a market where payment data can reveal sensitive information about an individual’s income, spending patterns, business activity and financial relationships.

The draft also gives the CBK powers to make regulations dealing with data sharing and open finance. Clause 76 specifically identifies sharing of data and open finance among the matters that may be addressed through regulations.

That means some of the practical details—such as technical standards, security requirements and operational procedures—would be developed through regulations after the primary legislation is enacted.

The proposal therefore creates the legal architecture while leaving important technical questions for subsequent regulatory instruments.

The 10-tier licensing framework

Another major change is the proposed restructuring of Kenya payment service providers into 10 licensing categories.

The First Schedule divides the categories into six payment service provider licences and four payment system operator licences.

Payment Service Provider categories

The six PSP categories are:

Payment Initiation Service Provider
Account Information Service Provider
Merchant Acquirer
Electronic Wallet Provider
Money Remittance Service Provider
Electronic Money Issuer

The four payment-system-operator categories are:

Payment Gateway
Payment Messaging System Operator
Card Scheme Operator
Payment Switching and Clearing System Operator

The structure reflects the changing nature of financial technology.

Instead of treating payment services as one broad activity, the proposed framework separates functions such as payment initiation, account-information services, merchant acquiring, electronic wallets and money remittances.

It also recognises infrastructure providers that facilitate payment transactions without necessarily being the institution holding customer funds.

Capital requirements will differ sharply

The licensing categories also come with different proposed minimum capital requirements.

The Third Schedule of the draft Bill proposes minimum capital ranging from KSh5 million for payment initiation and account-information service providers to KSh250 million for electronic-money issuers.

Statutory Clause	Proposed Regulatory Power	Sectoral Impact
Clause 29 — Open finance	CBK may require secure customer-data sharing with third parties after customer consent	Creates a framework for open finance, fintech competition and new financial services
Clause 5 — PSP licensing	CBK may issue licences across six PSP categories	Creates specialised licensing for different payment activities
Clause 6 — Payment-system operators	CBK may license four operator categories	Brings gateways, messaging, card schemes plus switching/clearing under defined categories
Clause 10 — Minimum capital	Licensees must maintain prescribed core capital	Raises financial resilience requirements, particularly for higher-risk operators
Clause 12 — Suspension/revocation	CBK may suspend or revoke licences for specified breaches	Gives the regulator stronger intervention powers
Clause 70 — Administrative enforcement	CBK may warn, direct, restrict, suspend, vary or revoke licences	Expands the enforcement toolkit
Clause 71 — Administrative penalties	CBK may fine PSPs/PSOs up to KSh20 million	Creates direct financial consequences for regulatory breaches
Clause 72 — Criminal penalties	Courts may impose up to KSh30 million on repeat-offending corporations	Raises the cost of serious or repeated statutory offences

The proposed figures are substantial.

Payment initiation and account-information providers would require KSh5 million each, while payment gateways would require KSh10 million.

Payment messaging-system operators would require KSh20 million.

Money-remittance providers would require KSh30 million.

Merchant acquirers, electronic-wallet providers, card-scheme operators and payment-switching/clearing operators would each require KSh50 million.

Electronic-money issuers face the highest proposed minimum at KSh250 million.

The different thresholds indicate that the Bill is attempting to match capital requirements to the nature and potential risk of each activity.

Existing banks still need CBK authorisation

The proposed framework also recognises that some institutions are already regulated under other financial laws.

Banks licensed under the Banking Act, microfinance banks and building societies would not need to apply for a separate payment-service-provider licence where they fall within the specified exemption.

However, they would still need to obtain CBK authorisation, comply with the proposed law and meet applicable capital requirements.

This prevents the licensing framework from creating an unnecessary second licensing process while retaining CBK oversight of payment activities.

Foreign companies can also apply if they are limited companies that have obtained a certificate of compliance under the Companies Act.

The draft Bill itself does not set out a separate provision using the term “foreign PSP branch registration”; instead, the foreign-company eligibility requirement is built into Clause 7.

CBK gets stronger intervention powers

The proposed Bill would significantly strengthen the regulator’s ability to intervene where a payment provider becomes a risk to customers or the wider financial system.

Under Clause 12, the CBK could suspend or revoke a licence for various reasons, including failure to maintain minimum capital, failure to meet licence conditions, failure to pay annual fees, infrastructure deficiencies, conduct posing a risk to the national payment system or public interests, prohibited activities and failure to comply with the law.

The process is not designed to be instantaneous.

Before suspending or revoking a licence, the CBK would have to give the provider an opportunity to make representations.

A suspension could initially last for up to six months and could be extended for another period of up to six months. If the provider fails to satisfy conditions imposed by the CBK, the licence could then be revoked.

The proposal therefore combines enforcement powers with procedural safeguards.

What happens after a licence is revoked?

The Bill goes further than simply removing a licence.

When a payment service provider’s licence is suspended or revoked, the CBK would take control of its assets for purposes including safeguarding customer money and overseeing settlement.

The Central Bank could manage and operate the provider for up to 90 days before the appointment of a statutory manager.

The proposed framework also allows the CBK to publish a notice of suspension or revocation in the Kenya Gazette and a newspaper with nationwide circulation.

A statutory manager could subsequently be appointed to manage the affected payment provider or operator.

These provisions are particularly important for customers because payment companies can hold or process large volumes of funds even when they are not banks.

The draft Bill seeks to ensure that regulatory action does not leave customers without a mechanism for protecting or settling their money.

KSh30 million penalties explained

The headline KES30 million penalty requires some clarification.

The Bill does not propose a blanket KSh30 million administrative fine for every regulatory breach.

Under Clause 71, the CBK could impose an administrative fine of up to KSh3 million on an officer, rising to KSh5 million for a repeat offender.

For a payment service provider or payment system operator, the proposed administrative fine is up to KSh20 million.

The CBK could also impose an additional penalty of up to KSh100,000 for each day or part of a day that a continuing failure or refusal persists.

The KSh30 million maximum arises under Clause 72.

Where a body corporate commits an offence for which no specific penalty is provided, the court could impose a fine of up to KSh20 million. In the case of a repeat offence, the maximum rises to KSh30 million.

Individuals could face a fine of up to KSh3 million or imprisonment for up to three years, while repeat offences could attract up to KSh5 million or five years’ imprisonment, or both.

That distinction is important when reporting the proposed CBK payment system fines 2026.

The KSh20 million figure relates to administrative enforcement by CBK, while KSh30 million relates to a court-imposed maximum for repeat corporate offences under the draft provision.

Enforcement goes beyond fines

Financial penalties are only one part of the proposed enforcement regime.

Clause 70 would allow the CBK to issue warnings, require remedial action, restrict business activities, suspend participation in the affairs of a provider, require the removal of certain directors or senior officers, protect customers through specific directions and suspend, vary or revoke licences.

Before administrative enforcement action is taken, the regulator would generally be required to issue a notice explaining the intended action and give the affected party an opportunity to show cause.

A person aggrieved by a CBK decision could also seek a review within 30 days and subsequently appeal to the High Court within 30 days of the review decision.

This creates an enforcement chain rather than relying exclusively on financial punishment.

Regulatory sandbox could encourage fintech innovation

The Bill also recognises that new payment technologies can develop faster than traditional licensing frameworks.

Clause 74 would allow the CBK to establish a regulatory sandbox through regulations.

The sandbox would provide limited access to the national payment system for testing innovative payment and settlement services without necessarily requiring a full licence during the testing phase.

That could be important for Kenyan fintech companies developing new payment technologies.

Instead of forcing an experimental product immediately into a full regulatory environment, the sandbox could give innovators a controlled space to test products while the regulator assesses risks.

The proposed framework would also require the sandbox regulations to establish criteria, minimum requirements and procedures for operating within it.

Interoperability becomes a regulatory expectation

The Bill is also designed to push the payment sector towards greater interoperability.

Payment service providers and payment system operators would be required to use systems capable of working with systems operated by other providers and operators.

The CBK could also require a provider to enter into interoperability arrangements with another payment provider or operator.

This provision could have significant implications for consumers and businesses.

A more interoperable market could reduce fragmentation between payment platforms and make it easier for users to transact across different systems.

For merchants, interoperability could potentially simplify payment acceptance.

For fintech companies, however, compliance could require substantial investment in technology, cybersecurity and system integration.

Customer money receives additional protection

The draft Bill also proposes stronger rules around customer funds held by electronic-money issuers and electronic-wallet providers.

All customer money received by these providers would have to be held in trust accounts.

Those funds could not simply be transferred into the provider’s normal operating account or mixed with unrelated funds.

The Fourth Schedule proposes that an electronic-money issuer or electronic-wallet provider should not hold more than KSh500 million or 25 per cent of its trust-account funds, whichever is higher, in a single bank.

The objective is to reduce concentration risk while ensuring that customer balances remain protected if a provider encounters financial difficulties.

The Bill could reshape Kenya’s digital payments market

If enacted substantially in its current form, the National Payment System Bill 2026 would create a considerably more detailed regulatory architecture for Kenya’s payment sector.

The biggest changes would not necessarily be visible to consumers immediately.

Behind the scenes, payment companies would face new licensing categories, capital requirements, system-audit obligations, data-sharing capabilities, interoperability requirements and stronger enforcement powers.

Public participation could still change the Bill

The legislation is not yet law.

The National Treasury public notice confirms that the draft Bill is undergoing public participation, with comments invited from members of the public and stakeholders.

That process matters because provisions dealing with customer-data sharing, capital requirements, licensing, foreign participation, enforcement and penalties can still be reviewed before the Bill reaches its final legislative form.

The draft nevertheless signals the direction in which Kenya’s payment-regulation framework could be heading.

The proposed law seeks to balance innovation with stronger supervision, while bringing newer financial technologies into a more clearly defined regulatory environment.

For banks, mobile-money companies, fintechs, payment gateways, remittance firms and consumers, the outcome of the legislative process will be worth watching closely.

The central question is no longer whether Kenya’s payment ecosystem is becoming more digital. That transformation is already underway.

The question is how the law will govern that transformation—and how effectively the proposed CBK open banking customer data sharing, 10-category licensing system, regulatory sandbox and enforcement regime can protect consumers while allowing payment innovation to continue.

Until Parliament completes the legislative process, the National Payment System Bill 2026 remains a draft. Its provisions, however, offer a clear indication of the regulatory architecture being considered for Kenya’s next phase of digital payments.