One Group, Four Regulators, One Super App
Kijabe Holdings Ltd is a Nairobi family office. It owns 100% of Kijabe Bank (a Tier 2 commercial bank), 62% of Kijabe SACCO (deposit-taking), 100% of Kijabe Remit (licensed money remittance), and 35% of Kijabe Advisory (CMA-licensed investment adviser). The group plans 'Kijabe One', a single mobile app that would let customers sweep bank deposits into a money market fund, obtain salary advances, buy insurance, and send money abroad. The CEO proposes a group-level compliance committee to 'consolidate regulatory reporting' and asks the bank to guarantee the remittance company's obligations. Kijabe Bank is also negotiating to acquire a distressed microfinance bank. The group wants to complete all launches in 90 days. The board asks whether one lead regulator can approve the whole proposition and what must be ring-fenced.
1. Map the principal regulators and approval triggers for each element of Kijabe One. Can one lead regulator approve the whole proposition?
Read the worked answer
No single regulator can approve the whole proposition because the group is conducting different regulated activities through separate legal entities. The analysis should start from the legal entity and the activity, not from the app.
- Kijabe Bank: the CBK licenses and supervises commercial banks under the Banking Act. The bank's deposit-taking, lending and salary-advance product are core banking business. Any mobile channel must fit CBK outsourcing, consumer-protection and cyber rules.
- Kijabe SACCO: deposit-taking SACCO business is supervised by SASRA under the SACCO Societies Act. The group cannot use the bank licence to take SACCO deposits or vice versa.
- Kijabe Remit: money remittance is licensed by the CBK under the National Payment System framework. The bank guarantee request is a separate related-party exposure issue.
- Money market fund: a collective investment scheme requires CMA approval, with an approved fund manager, trustee/custodian and disclosure document. The bank cannot simply sell it as a deposit product.
- Insurance distribution: selling insurance requires an IRA licence or an approved corporate agency arrangement; bank staff cannot distribute policies under the bank licence alone.
- Kijabe Advisory: the 35% stake does not let the group use the adviser's licence for group products. Investment advice and dealing need CMA licensing.
- Data: the app's cross-entity data sharing engages the ODPC under the Data Protection Act 2019.
The 90-day timetable is unrealistic. The group should sequence entity-level approvals, product approvals, outsourcing notifications and customer disclosures before launch.
2. Advise the board on ring-fencing and on the CEO's proposal that Kijabe Bank guarantee Kijabe Remit's obligations.
Read the worked answer
The board should reject any suggestion that the group can operate as one balance sheet. Kenyan financial-sector regulation is entity-based and seeks to prevent contagion from one licensed entity to another.
A bank guarantee of a remittance company's obligations is a related-party exposure. It must be approved on arm's length terms, within the bank's large-exposure and related-party limits, and with CBK engagement where required. The bank's capital and liquidity cannot be used to support group ventures without transparent pricing, board approval and regulatory notification. The guarantee could also mislead remittance customers into believing the bank stands behind the remittance service.
Ring-fencing should cover:
- Capital and liquidity: each entity maintains its own regulatory capital and liquidity; no informal group sweeps.
- Client money: remittance and investment client funds must be segregated from group operating accounts.
- Governance: the group compliance committee can coordinate, but each entity needs its own board, compliance officer and money-laundering reporting officer with direct access to its regulator.
- Data: customer data should not flow across entities for marketing or credit scoring without a lawful basis and clear notices.
- Branding: the app must identify the licensed entity providing each product and avoid implying that all products carry bank deposit protection.
The group should also check merger-control thresholds with the Competition Authority for the microfinance bank acquisition, in addition to CBK approval.
3. What customer-protection and data-sharing controls should be in place before the super app goes live?
Read the worked answer
The app design should make the regulated entity visible at the point of sale. A customer sweeping money from a bank account into a money market fund is moving from a deposit to a CMA-regulated collective investment scheme; that is not a deposit and may lose value. The screen must say so, show fees, and obtain separate consent.
Data sharing across the bank, SACCO, remittance company and adviser needs a lawful basis under the Data Protection Act 2019. A single 'accept all' consent is weak. The group should map each data flow, apply purpose limitation and data minimisation, and give a layered privacy notice. Sharing trading data with a lender for credit scoring is a different purpose and needs specific disclosure and consent or another lawful basis. Cross-border transfers require safeguards.
Operationally, the group should test:
- complaint handling and escalation across entities;
- disclosure of whether funds are protected by deposit insurance or the Investor Compensation Fund;
- clear error-resolution and reversal rules for failed sweeps;
- retention and access rules for customer records;
- breach notification routes to the ODPC and affected customers.
Launch should be gated on regulator engagement and user testing, not on the CEO's 90-day target.