The Central Bank of Kenya (CBK) has proposed a new law that will require banks and digital payment providers to share customer data with licensed third parties. This move aims to promote open banking, market development, and fair competition in the national payment system. The draft National Payment System Policy and National Payment System Bill, 2026, outlines the regulations that financial institutions must follow to ensure secure data sharing.
The proposed law will require banks and service providers to create secure systems that protect data shared with third parties. According to the Act, each payment service provider or payment system operator must use systems capable of securely sharing customer data with third parties for open finance purposes. This will enable fintech companies to reach more customers without owning their accounts, provided they have obtained the customer's consent.
The CBK believes that the new law will promote transparency in the national payment system. By allowing fintechs to access customer data, they can offer more targeted and efficient services, ultimately benefiting the customer. The law also requires payment service providers or payment system operators to implement a mechanism to securely share customer data with third parties after obtaining the customer’s consent.
The proposed law has significant implications for banks and payment platforms like M-Pesa, which currently own and keep customer transaction data. The new law will loosen the rigid mechanism of customer relationships, allowing for more collaboration between financial institutions and fintech companies. This shift is expected to drive innovation and competition in the digital payments sector.
The law also includes strict penalties for non-compliance. Payment service providers or payment system operators that fail to commence business within twelve months from the date the license is issued will have their operational licenses revoked. Additionally, committing an offence under the provisions of the Act will result in individuals paying a fine not exceeding Ksh.3 million or imprisonment for a term not exceeding three years.
Corporate entities that violate the law will be liable to a fine not exceeding Ksh.20 million, rising to Ksh.30 million in case of a repeat offence. Furthermore, each payment service provider and payment system operator will be required to submit audited financial statements in respect of its activities in Kenya for a specified year not later than three months after the end of each financial year.
The CBK has invited members of the public to participate in nationwide public participation conducted by the National Treasury and the CBK. Submissions should be made to CBK Governor Kamau Thugge by October 9. This provides an opportunity for stakeholders to provide feedback on the proposed law and shape the future of digital payments in Kenya.
Key points
- The proposed law aims to promote open banking and fair competition in the national payment system.
- The law requires banks and digital payment providers to share customer data with licensed third parties.
- The law includes strict penalties for non-compliance, including fines and imprisonment.
