New CRB Regulations in Kenya 2023–2026: What Has Changed

Why the Regulatory Landscape Keeps Evolving

Kenya's credit reporting framework, established under the Banking Act, has been updated multiple times since the original CRB Regulations of 2013. The rapid growth of digital lending — from M-Shwari in 2012 to dozens of apps today — has forced CBK and Parliament to repeatedly tighten rules around consumer protection, data handling, and lender conduct.

Key Development: Digital Credit Provider (DCP) Licensing (2022 Onwards)

The Central Bank of Kenya Act Amendment 2021 gave CBK authority to regulate previously unregulated digital lenders. The licensing framework took effect from 2022, requiring all digital credit providers to:

• Obtain a CBK Digital Credit Provider licence
• Comply with CRB Regulations (including mandatory reporting)
• Follow transparent pricing and customer complaint procedures
• Adhere to responsible lending guidelines
• Not list borrowers with CRBs without prior notification

By 2025, CBK had licensed over 60 DCPs, with dozens more applications in process.

Key Development: Small Loan CRB Listing Threshold Changes

One of the most significant consumer protection reforms in recent years was the revision of the minimum loan amount that can trigger a CRB listing. Changes aimed to prevent borrowers with very small outstanding balances from being listed, which had resulted in millions of Kenyans being blacklisted over amounts as small as KES 1.

Under revised guidelines, lenders must:

• Consider the proportionality of any CRB listing to the outstanding balance
• Exhaust internal collection efforts before submitting a CRB listing
• Notify the borrower via SMS and give a 7-day cure window before listing

Data Protection Act 2019 Interaction

Since its commencement, the Data Protection Act 2019 has had growing practical overlap with CRB regulations:

• Credit bureaus are registered as data processors under the ODPC
• Borrowers have strengthened rights to access, correct, and request deletion of their data
• Lenders cannot share borrower data with third parties (including CRBs) without appropriate legal basis under the DPA
• The ODPC has been increasingly active in investigations involving fintech data practices

Government Debt Relief Initiatives (2023)

In 2023, President Ruto's administration announced debt relief measures that intersected with CRB listings:

• Targeted waiver of CRB listings for the Hustler Fund defaulters who repaid
• Negotiations with digital lenders over mass review of small-value negative listings
• Directive for banks and SACCOs to restructure pandemic-era NPLs

These measures had a material effect on millions of Kenyan CRB files between 2023 and 2025.

What This Means for Borrowers in 2026

The overall direction of Kenya's CRB regulation is stronger consumer protection, more transparent lending, and a more balanced credit information ecosystem. For borrowers in 2026:

• More lenders are regulated and must follow the rules before listing you
• You have stronger rights under DPA 2019 to challenge data held by bureaus
• Very small outstanding amounts are less likely to generate automatic CRB listings
• Government relief programs may have already resolved some historical issues on your file

The best way to know exactly where you stand in 2026 is to run your current CRB report and review it against these updated rules.