Regulations and Market Practice (Kenya) cheat sheet

The Central Bank of Kenya (CBK) is established under Article 231 of the Constitution and the Central Bank of Kenya Act (Cap 491); it licenses and supervises banks, mortgage finance companies and forex bureaux.

The Capital Markets Authority (CMA) is a statutory body under the Capital Markets Act (Cap 485A); it licenses market intermediaries and approves securities offerings, collective investment schemes and market infrastructure.

The Insurance Regulatory Authority (IRA) licenses insurers, brokers and agents under the Insurance Act (Cap 487); the Retirement Benefits Authority (RBA) regulates schemes and administrators under the Retirement Benefits Act 1997.

The National Treasury (State Department for Financial Services) sets policy and sponsors legislation; the Cabinet Secretary for the National Treasury appoints CMA board members and approves regulations.

The Kenya Deposit Insurance Corporation (KDIC) provides depositor protection under the Kenya Deposit Insurance Act 2012; the Policyholders Compensation Fund does the analogous role for insurance.

The Financial Reporting Centre (FRC) is the financial intelligence unit under the Proceeds of Crime and Anti-Money Laundering Act 2009 (POCAMLA); it receives reports and disseminates intelligence.

The Competition Authority of Kenya reviews mergers and acquisitions across sectors, including financial institutions, under the Competition Act 2010; CBK also approves bank mergers and acquisitions.

The Office of the Data Protection Commissioner enforces the Data Protection Act 2019; the Business Laws (Amendment) Act 2020 and the Companies Act 2015 govern corporate and securities-adjacent matters.

The Financial Markets Conduct Authority concept has been discussed in Kenya's policy agenda to consolidate market conduct; until enacted, conduct remains split across CBK, CMA, IRA and RBA.

Bank licensing: minimum core capital for a bank is KES 1 billion, rising to KES 5 billion, and KES 15 billion for a mortgage finance company, per CBK prudential guidelines phased over time.

Bank licence applicants must submit a business plan, capital structure, fit-and-proper evidence for directors and senior officers, and a three-year financial projection to CBK.

CMA licences market intermediaries including stockbrokers, investment banks, investment advisers, fund managers and collective investment scheme trustees; application requires fit-and-proper persons and minimum paid-up capital.

CMA capital requirements are tiered by licence class; a stockbroker/dealer must meet minimum paid-up capital and maintain a liquidity ratio, with periodic returns to CMA.

Securities public offers require CMA approval of a prospectus; the Capital Markets (Securities) (Public Offers, Listing and Disclosures) Regulations 2002 set disclosure and eligibility rules.

Insurance intermediaries must be licensed by IRA; insurance brokers require professional indemnity cover and minimum capital as prescribed by the Insurance Act and IRA guidelines.

Foreign entry: CBK and CMA review fit-and-proper, home-country supervision, reciprocal arrangements and anti-money laundering compliance for foreign-owned applicants.

Approval timelines are statutory but extendable; CBK and CMA can impose conditions, restrict activities and require ongoing compliance with prudential and conduct rules.

The Capital Markets Act (Cap 485A) empowers CMA to approve prospectuses, register securities exchanges and central depositories, and license intermediaries.

The Nairobi Securities Exchange (NSE) is a licensed securities exchange; the Central Depository and Settlement Corporation (CDSC) holds securities in immobilised/electronic form under CMA oversight.

Listed issuers must comply with the NSE Listing Rules and CMA continuing disclosure obligations: immediate disclosure of material price-sensitive information and periodic financial reporting.

Collective investment schemes (CIS) are regulated under the Capital Markets (Collective Investment Schemes) Regulations 2001; trustees must be independent and CMA-approved.

The Capital Markets (Foreign Investors) Regulations permit foreign participation subject to registration and reporting; foreign investor limits apply in specified sectors.

Takeovers and mergers of listed companies are governed by the Capital Markets (Takeovers and Mergers) Regulations 2002, requiring mandatory offers above threshold shareholding.

Asset-backed securities and REITs are governed by specific CMA regulations; REITs require trustee, manager and property manager licensing.

Market intermediaries must maintain minimum capital, submit audited accounts and comply with CMA's code of conduct for market intermediaries.

CBK prudential requirements: minimum core capital adequacy ratio of 10.5% and total capital adequacy ratio of 14.5%, plus a conservation buffer, under the Banking Act and CBK Prudential Guidelines.

The Banking Act (Cap 488) restricts insider lending and large exposures; single obligor limits cap credit to one borrower as a percentage of core capital.

Banks must maintain a statutory minimum liquidity ratio (currently 20%) and submit liquidity returns to CBK; the CBK also sets cash reserve requirements.

The Banking Act requires CBK approval for significant shareholding changes (typically 5% or more), director appointments and changes of control.

Problem banks may be placed under CBK statutory management or receivership; KDIC insures eligible deposits up to a prescribed limit.

The Microfinance Act 2006 licenses deposit-taking microfinance institutions; saccos are regulated under the Sacco Societies Act 2008 by SASRA.

Consolidated supervision extends to bank holding companies and subsidiaries; CBK supervises cross-border operations through supervisory colleges.

The National Payment System Act 2011 empowers CBK to license and oversee payment service providers, mobile money and payment systems.

POCAMLA 2009 (as amended) requires reporting institutions to register with the FRC, conduct CDD, keep records and file suspicious transaction reports.

Kenya's AML regime is supplemented by the Prevention of Terrorism Act 2012 and the Terrorism (Prevention and Prohibition) Act; terrorist financing reporting is mandatory.

Reporting institutions must apply risk-based CDD, enhanced due diligence for PEPs and correspondent relationships, and simplified CDD only in low-risk cases.

Suspicious transaction reports (STRs) must be filed with the FRC promptly; tipping off the customer is prohibited.

Kenya implements UN Security Council sanctions through the Prevention of Terrorism Act and subsidiary legislation; institutions must screen against designated lists.

The FRC shares intelligence with the National Intelligence Service, DPP and other agencies; failure to report can attract criminal and administrative sanctions.

Record-keeping: POCAMLA requires retention of transaction and CDD records for at least five years after the relationship ends or the transaction is completed.

The AML/CFT (Amendment) Act and FRC guidelines prescribe governance, training and independent audit obligations for reporting institutions.

CBK's Prudential Guidelines on consumer protection require fair treatment, transparent charges, complaint handling and disclosure of terms before contracting.

CMA's Code of Conduct for Market Intermediaries requires segregation of client assets, disclosure of conflicts, best execution and suitability assessments.

Client money must be held in designated trust or client accounts; intermediaries must reconcile client assets and maintain records of client holdings.

The Competition Act 2010 and CBK/CMA rules prohibit misleading advertising and unfair contract terms; the Consumer Protection Act 2012 provides general redress.

Complaints must be logged and resolved within prescribed timelines; unresolved complaints can be escalated to CBK, CMA or the relevant ombudsman.

Insurance conduct is governed by the Insurance Act and IRA guidelines on disclosure, claims handling and agent conduct.

Data protection and confidentiality overlay conduct: customer information may only be shared with consent or under legal compulsion.

Financial institutions must publish tariff guides and key facts statements; hidden fees and unfair debt collection practices attract supervisory action.

The NSE operates an automated trading system; trading is conducted through licensed stockbrokers and investment banks, with settlement through CDSC on a T+3 cycle.

The CDSC provides central securities depository services, immobilisation and book-entry transfer; settlement is delivery-versus-payment through the central bank settlement system.

Only licensed exchanges and approved trading venues may operate; off-exchange trading is restricted, and over-the-counter transactions must be reported.

Market makers and liquidity providers are recognised under NSE rules with obligations on quoting and inventory; short selling is restricted unless permitted by CMA.

Clearing and settlement risk is managed through a guarantee fund, margin requirements and default procedures administered by CDSC and the exchange.

The National Payment System Act 2011 governs payment systems and mobile money; CBK oversees payment service providers and systemically important systems.

Kenya operates a hybrid market structure: NSE for equities and bonds, plus an over-the-counter bond market with reporting to the NSE and CBK.

Market infrastructure must meet CMA's operational risk, business continuity and cyber resilience requirements.

The Capital Markets Act prohibits insider dealing, market manipulation, false trading and misleading statements; CMA can investigate and impose sanctions.

Issuers must disclose material price-sensitive information immediately to the exchange and CMA; selective disclosure to analysts or journalists is prohibited.

Insider dealing rules cover directors, employees and tippees; dealings during closed periods and while in possession of inside information are prohibited.

CMA requires issuers to maintain insider lists and disclose directors' dealings; listed companies must adopt a dealings policy.

Market manipulation includes wash trades, painting the tape, spoofing and dissemination of false information; surveillance is conducted by NSE and CMA.

CMA can impose administrative penalties, disgorgement and refer criminal cases to the DPP; the Capital Markets Tribunal hears appeals.

Continuous disclosure obligations include periodic financial reporting, changes in control and material litigation; failure can lead to suspension or delisting.

Whistleblower protections and cooperation credit are recognised in CMA enforcement policy.

The Data Protection Act 2019 establishes the Office of the Data Protection Commissioner; processing requires lawful basis, purpose limitation and data minimisation.

Data controllers must register with the ODPC where required, conduct data protection impact assessments for high-risk processing and appoint a data protection officer in specified cases.

Cross-border transfers are permitted only where the recipient country has adequate protection or appropriate safeguards exist; consent and contractual clauses are common bases.

Data subjects have rights of access, rectification, erasure and objection; breaches must be notified to the ODPC and affected persons without undue delay.

Banking confidentiality under the Banking Act restricts disclosure of customer information; exceptions include statutory reporting, court orders and AML reporting.

POCAMLA requires retention of records for at least five years; CMA and CBK require retention of books and records for prescribed periods (often six to seven years).

Records must be retrievable, accurate and secure; electronic records are acceptable if they meet integrity and auditability standards.

Confidentiality obligations survive the end of the client relationship and apply to former employees and outsourced service providers.

Supervisory colleges and memoranda of understanding coordinate CBK, CMA, IRA and RBA oversight of financial groups and cross-border operations.

The National Treasury's Financial Sector Regulators Forum coordinates policy among CBK, CMA, IRA, RBA, SASRA and FRC.

Risk-based supervision is the dominant model: institutions are rated and supervised proportionately to their risk profile.

Enforcement tools include supervisory letters, restrictions on business, administrative penalties, statutory management and referral for prosecution.

The Capital Markets Tribunal and the Banking Appeals Tribunal hear appeals against regulatory decisions; further appeal lies to the High Court.

Regulatory sandboxes, such as CBK's fintech sandbox, allow controlled testing of innovations under supervisory oversight.

Financial stability is monitored through the Financial Stability Report and macroprudential tools applied by CBK.

Regulators publish guidelines, circulars and codes that supplement statutes; compliance with these is enforceable as part of licence conditions.

Fit-and-proper tests apply across all sectors: honesty, competence, financial soundness and absence of disqualifying convictions.

Change-of-control approvals are required across banking, insurance and capital markets; failure to obtain approval can void the transaction.

Minimum capital requirements differ by licence class and are periodically revised; applicants must demonstrate ongoing compliance, not just entry compliance.

Outsourcing and third-party arrangements require notification or approval where they affect critical functions.

AML/CFT compliance programmes are a condition of licensing for banks, insurers, capital market intermediaries and payment providers.

Foreign applicants must demonstrate home-country consolidated supervision and willingness to share supervisory information.

Licences are generally non-transferable; material changes to business plans require prior regulatory approval.

Regulators can impose conditions, restrict new business or revoke licences for non-compliance; appeals follow statutory tribunal routes.

CIS trustees must be independent of the fund manager and hold assets in trust; the trustee oversees valuation and compliance.

Fund managers must be CMA-licensed and meet minimum capital; they must disclose fees, valuation policies and conflicts.

Investor compensation arrangements and client asset segregation protect investors if an intermediary fails.

Prospectus liability attaches to issuers, directors and advisers for misleading statements; due diligence defences are limited.

Listed companies must publish annual and interim financial statements within prescribed timelines and hold shareholder meetings.

Minority shareholder protections include pre-emption rights, related-party transaction approval and mandatory offer rules.

CMA can suspend trading, order rectification and impose penalties for disclosure failures.

Investor education and complaint-handling obligations rest with intermediaries and the exchange.

Banks must file large cash transaction reports and suspicious transaction reports; thresholds and formats are set by FRC guidance.

Capital market intermediaries must conduct CDD on beneficial owners and screen against sanctions lists before onboarding.

Insurance sector AML obligations cover life insurance and investment-linked products; IRA and FRC issue joint guidance.

Mobile money and payment providers are reporting institutions under POCAMLA and must implement risk-based AML controls.

Correspondent banking relationships require enhanced due diligence and senior management approval.

PEPs, including domestic PEPs, require enhanced due diligence and source-of-funds verification.

Independent audits and AML/CFT training are mandatory; supervisors test effectiveness, not just policy existence.

Record retention and STR confidentiality are core obligations; tipping off is a criminal offence.

CMA's surveillance relies on exchange data, whistleblowers and cooperation with the FRC and DPP.

Investigations can lead to administrative sanctions, disgorgement, public censure and criminal referral.

The Capital Markets Tribunal hears appeals; further appeal to the High Court on points of law.

Insider dealing enforcement requires proof of possession of inside information and dealing or tipping.

Market manipulation cases often rely on trading pattern analysis and communications evidence.

Issuers must cooperate with investigations; obstruction can itself be sanctioned.

CMA publishes enforcement actions to deter misconduct and inform the market.

Cross-border cooperation occurs through IOSCO multilateral memoranda of understanding.

Data protection impact assessments are required for high-risk processing, including large-scale profiling and sensitive data.

Data processing agreements must be in place with processors; controllers remain liable for processor failures.

Breach notification to the ODPC and data subjects is required without undue delay where there is risk to rights.

Records of processing activities must be maintained and made available to the ODPC on request.

Consent must be freely given, specific, informed and withdrawable; bundled consent is invalid.

Sensitive personal data, including health and financial data, attracts stricter processing conditions.

Data protection officers must be appointed where processing is large-scale or involves sensitive data.

Cross-border transfer safeguards include adequacy decisions, standard contractual clauses and binding corporate rules.

Retention periods vary: POCAMLA requires at least five years; CMA and CBK require longer periods for books and records.

Records must be stored in a manner that allows prompt retrieval and reconstruction of transactions.

Confidentiality exceptions include AML reporting, court orders, regulatory requests and client consent.

Outsourced record-keeping must preserve regulatory access and confidentiality.

Destruction of records must follow a documented retention schedule and legal holds.

Employee confidentiality obligations continue after employment ends.

Regulators can request records during examinations; failure to produce is a breach of licence conditions.

Electronic records must meet integrity, auditability and security standards.

Intermediaries must maintain a complaints register and resolve complaints within prescribed timelines.

Unresolved complaints can be escalated to CBK, CMA, IRA or the relevant ombudsman.

The Banking Appeals Tribunal and Capital Markets Tribunal provide formal appeal routes against regulatory decisions.

Consumer redress may also be sought through courts and the Competition Authority.

Compensation schemes exist for depositors (KDIC) and policyholders (Policyholders Compensation Fund).

Intermediaries must disclose complaint-handling procedures at onboarding.

Regulators publish complaint data and thematic reviews to drive conduct improvements.

Mis-selling and unfair terms attract supervisory action and potential restitution orders.

The National Payment System Act 2011 empowers CBK to license payment service providers and oversee payment systems.

Mobile money providers must comply with CBK guidelines on interoperability, consumer protection and AML/CFT.

CBK's fintech sandbox allows controlled testing under supervisory oversight.

Payment system participants must meet operational risk and cyber resilience standards.

Interoperability rules require fair access and transparent pricing among payment providers.

Stored-value limits and safeguarding requirements protect customer funds.

CBK can designate systemically important payment systems and impose additional requirements.

Cross-border payment services are subject to AML/CFT and data protection rules.

Listed issuers must disclose material price-sensitive information immediately.

Periodic reporting includes annual audited financial statements and interim results within prescribed timelines.

Related-party transactions require disclosure and, where material, shareholder approval.

Changes in directors, auditors and control must be disclosed promptly.

Selective disclosure is prohibited; information must be released to the market as a whole.

Insider lists and directors' dealings disclosures are required.

Failure to disclose can lead to suspension, delisting and penalties.

CMA reviews disclosure and can order correction of misleading statements.

Enforcement tools include warnings, restrictions, penalties, statutory management and licence revocation.

The Capital Markets Tribunal and Banking Appeals Tribunal hear appeals against regulatory decisions.

Further appeal lies to the High Court on points of law.

Regulators publish enforcement actions and thematic findings.

Cooperation credit and whistleblower protections are recognised in enforcement policy.

Criminal referrals go to the DPP; AML cases may involve the FRC and NIS.

Regulatory decisions must follow fair administrative action under Article 47 of the Constitution.

Judicial review is available for procedural fairness challenges.

CBK supervises cross-border operations through supervisory colleges and MOUs.

Foreign applicants must demonstrate home-country consolidated supervision.

IOSCO multilateral MOUs support cross-border securities enforcement cooperation.

AML/CFT cross-border cooperation occurs through the FRC and international counterparts.

Data protection cross-border transfers require adequacy or safeguards.

Group-wide risk management and capital adequacy are assessed on a consolidated basis.

Regulators can share confidential information under statutory gateways.

Cross-border resolution planning is coordinated with home supervisors.

Institutions must disclose fees, charges and terms before contracting.

Tariff guides and key facts statements must be published.

Misleading advertising and unfair contract terms are prohibited.

Vulnerable customers require additional care and clear communication.

Complaint-handling procedures must be disclosed at onboarding.

Debt collection practices are regulated; harassment is prohibited.

Redress routes include internal complaints, regulators, ombudsmen and courts.

Regulators conduct thematic reviews and publish conduct data.

Board and senior management are responsible for AML/CFT compliance.

A designated AML compliance officer must be appointed.

Staff training must be regular and role-appropriate.

Independent audits test the effectiveness of AML controls.

Policies must be documented and updated for regulatory changes.

Risk assessments must be documented and reviewed periodically.

STR confidentiality and tipping-off prohibitions apply to all staff.

Record retention and retrieval must be demonstrable.

Inside information is information not generally available that would likely affect price.

Dealing or tipping while in possession of inside information is prohibited.

Closed periods restrict dealings by directors around results announcements.

Insider lists must be maintained and updated.

Directors' dealings must be disclosed to the exchange.

Market manipulation includes wash trades, spoofing and false rumours.

CMA investigates and can impose penalties and refer for prosecution.

Appeals go to the Capital Markets Tribunal.

Data subjects have rights of access, rectification, erasure and objection.

Breaches must be notified to the ODPC and affected persons without undue delay.

Records of processing must be maintained.

DPO appointment is required in specified cases.

DPIAs are required for high-risk processing.

Consent must be freely given and withdrawable.

Sensitive data attracts stricter conditions.

Cross-border transfers require safeguards.

POCAMLA requires at least five years' retention.

CMA and CBK require longer retention for books and records.

Records must be retrievable and reconstructable.

Electronic records must meet integrity standards.

Legal holds suspend destruction.

Outsourced record-keeping must preserve regulatory access.

Confidentiality obligations survive the relationship.

Regulators can request records during examinations.

Stored-value limits protect customer funds.

Safeguarding requirements apply to customer funds.

Interoperability rules require fair access and transparent pricing.

Operational risk and cyber resilience standards apply.

AML/CFT obligations apply to payment providers.

CBK can designate systemically important systems.

Consumer complaints must be handled within timelines.

Cross-border payments are subject to AML/CFT and data protection rules.

Public offers require CMA approval of a prospectus.

Prospectus liability attaches to issuers, directors and advisers.

Due diligence defences are limited.

Disclosure must be accurate, complete and not misleading.

Supplementary prospectuses are required for material changes.

Offers must comply with eligibility and listing rules.

CMA can suspend or prohibit offers.

Investor compensation arrangements protect investors.

Institutions are rated and supervised proportionately to risk.

Supervisory colleges coordinate group oversight.

MOUs facilitate information sharing.

The Financial Sector Regulators Forum coordinates policy.

Macroprudential tools are applied by CBK.

The Financial Stability Report monitors systemic risk.

Regulators publish guidelines and circulars.

Compliance with guidelines is enforceable as licence conditions.

Fit-and-proper tests apply across sectors.

Change-of-control approvals are required.

Material changes to business plans require approval.

Licences are generally non-transferable.

Outsourcing of critical functions requires notification.

AML/CFT programmes are a licensing condition.

Foreign applicants must demonstrate home-country supervision.

Regulators can impose conditions or revoke licences.

REITs require trustee, manager and property manager licensing.

Asset-backed securities are governed by specific CMA regulations.

Disclosure requirements apply to issuers and sponsors.

Investor protection rules apply.

Valuation and conflicts rules apply.

CMA can suspend or prohibit offerings.

Tax treatment is set by the Income Tax Act.

Listing rules apply to listed REITs.

Article 47 of the Constitution guarantees fair administrative action.

Judicial review is available for procedural fairness challenges.

Regulators must give reasons for decisions.

Appeals follow statutory tribunal routes.

Further appeal lies to the High Court on points of law.

Regulatory decisions must be proportionate.

Confidentiality gateways govern information sharing.

Cooperation credit and whistleblower protections apply.