Regulatory Alert: The CBK’s Strategy to Reshape Digital Finance (2025-2028)

The Central Bank of Kenya (CBK) has launched a new regulatory roadmap that will fundamentally change how mobile money and digital credit operate in Kenya. Through the National Financial Inclusion Strategy 2025–2028, the CBK is moving away from a hands-off approach towards strict price controls and mandatory consumer protection.

For fintech operators, investors, and practitioners, this shift requires a total rethink of current business models and compliance protocols.

Reducing Mobile Money Transaction Costs

The CBK’s primary goal is to make digital payments more affordable for the average Kenyan. Currently, the average cost of a mobile money transaction is approximately KES 23. The CBK intends to reduce this to KES 10 by 2028.

This reduction will be achieved through a series of price caps on person-to-person (P2P) transfers. The regulator believes that high fees have caused a plateau in the growth of digital payments, leading many users to return to cash. By forcing fees down, the CBK expects to increase the volume of digital transactions.

Legal and Commercial Implications:

Under the National Payment System Regulations, the CBK is empowered to ensure that payment services are accessible and affordable. While fees have historically been left to market forces, the CBK now intends to enforce P2P transfer caps.

For dominant players, this represents a structural threat to traditional revenue streams. However, it also opens a path for velocity-driven Growth. By lowering the barrier to entry for micro-transactions, the CBK expects an increase in overall transaction volume, moving the economy closer to a cash-lite reality. Providers must now pivot toward value-added services, such as merchant payments and micro-wealth management, where margins are not yet capped.

The 2026 Fraud Compensation Framework

By the end of 2026, the CBK will implement a formal framework to compensate victims of digital fraud. In the past, consumers who lost money through system vulnerabilities or unauthorized transactions often had no clear way to recover their funds.

This new framework will introduce several legal requirements:

1. Provider Liability: Mobile money operators will be held more accountable for security breaches within their systems.

2. Clear Recourse Paths: Companies must establish transparent processes for customers to report fraud and receive compensation.

3. Data Security: In alignment with the Data Protection Act 2019, the CBK will require data controllers and processors to secure financial data. Operators will have to show they have used the highest standards of encryption and identity verification to prevent fraud, essentially shifting the risk onto the provider to prove they maintained "Security by Design."

Increasing Competition through UPI

To further lower costs, the CBK is exploring the introduction of a system similar to India’s Unified Payments Interface (UPI). This technology allows for real-time, low-cost transfers between different banks and mobile wallets without the need for expensive intermediaries.

The introduction of such a system would end the dominance of closed ecosystems. It will allow smaller fintech companies to compete on a level playing field with major telecommunications firms, as users will be able to send and receive money across different platforms more easily and at a lower cost.

Our Perspective:

These reforms do not exist in isolation. They represent a broader regulatory tightening where the posture of various agencies is finally converging. The NFIS 2025-2028 sits alongside the DCP licensing regime, increasing enforcement of data protection by the ODPC, and aggressive competition oversight by the Competition Authority of Kenya (CAK).

We are witnessing a shift in the Kenyan market from innovation-led growth to supervision-anchored stability. This transition targets three non-negotiable outcomes:

1. Transparent pricing that treats digital payments as a public utility.

2. Accountable data practices where the provider bears the risk of system failure.

3. Defined consumer recourse that moves beyond "best effort" to a statutory right.

While this transition inevitably increases compliance friction in the short term, it is designed to produce the long-term market confidence necessary for the next stage of Kenya's digital economy.

Counsel Strategist is a publication of Gillian Neky & Co. Advocates, offering insights at the intersection of business, technology, and the law. As the CBK moves toward a more regulated environment, staying ahead of these policy shifts is essential for commercial survival.

For further commentary on AI governance, digital policy, and data protection in Africa, contact our Technology, Privacy & Governance team at law@nekyadvocates.com.