Regulations and Market Practice (Kenya) common mistakes
Regulations and Market Practice (Kenya) · Understand the traps and how to avoid them.
Treating the Capital Markets Authority, the Central Bank of Kenya and the Insurance Regulatory Authority as interchangeable 'financial regulators' and assigning a licensing question to the wrong one.
Candidates memorise the acronyms but never build a map of which statute gives which body power over which activity, so they default to whichever regulator they saw most recently.
What to do instead
Build a one-page matrix of statute-to-regulator-to-activity: CMA under the Capital Markets Act for securities, collective investment schemes and market intermediaries; CBK under the Banking Act and CBK Act for banks, forex bureaux and payment service providers; IRA for insurers; RBA for pension schemes; SASRA for SACCOs. For each practice question, name the activity first, then the statute, then the regulator.
Answering that a bank licence, capital markets licence or payment service provider authorisation can be obtained by simply filing an application and paying a fee, ignoring the fit-and-proper, capital and pre-authorisation inspection stages.
Candidates conflate 'application' with 'approval' and underestimate the staged, discretionary nature of Kenyan market entry.
What to do instead
Learn the typical sequence: application with prescribed forms and fees, fit-and-proper assessment of directors and significant shareholders, minimum capital verification, CBK or CMA review, pre-licensing inspection, then grant with conditions. Be ready to state that approval is discretionary and conditions can be attached.
Confusing minimum core capital with capital adequacy ratios, or quoting capital figures without the currency, and applying bank capital rules to capital markets intermediaries.
Capital numbers are heavily tested and easy to half-remember; candidates mix the absolute minimum capital requirement with risk-weighted adequacy ratios and with the capital markets intermediary net capital rules.
What to do instead
Separate the concepts: minimum core capital is an absolute shilling amount for banks; capital adequacy is a ratio of capital to risk-weighted assets; capital markets intermediaries are governed by CMA net capital and financial resource requirements. If you cannot recall an exact figure with confidence, describe the principle and the regulator's power to prescribe rather than inventing a number.
Treating AML/CFT obligations as a single 'report suspicious transactions' rule and omitting customer due diligence, beneficial ownership, record-keeping, ongoing monitoring and targeted financial sanctions screening.
Suspicious transaction reporting is the most memorable obligation, so candidates stop there and lose marks on the wider framework.
What to do instead
Memorise the obligation set as a chain: risk assessment, CDD and enhanced due diligence for PEPs and high-risk customers, identification of beneficial owners, ongoing monitoring, record retention, reporting to the Financial Reporting Centre, and screening against sanctions designations with immediate freezing and reporting. Be able to say who supervises AML compliance for each sector.
Mixing up insider dealing, market manipulation and false or misleading disclosure, and applying the wrong prohibition to a scenario.
All three sit under market abuse and candidates respond to the word 'abuse' rather than to the specific conduct described.
What to do instead
Define each before answering: insider dealing is trading or tipping on unpublished price-sensitive information from an inside source; manipulation is creating a false or misleading appearance of trading or price; misleading disclosure is publishing false statements. Identify the actor, the information and the effect on price, then match the prohibition.
Assuming client money can be held in the firm's own operating account as long as records show who owns it, or that client assets rules are the same across banking and securities.
Candidates generalise from retail banking practice, where deposits become the bank's money, to securities and investment business, where client assets must be segregated.
What to do instead
Learn the segregation principle: client money and client investments must be held separately from firm assets, typically in designated client accounts or with an approved custodian, reconciled regularly, with no commingling and controlled use. Note that bank deposits are owed to the customer as a debt, which is a different legal position from client assets held in trust or custody.
Answering data protection questions using GDPR terminology and timeframes without checking the Kenyan statute, for example assuming a 72-hour breach notification or a European-style supervisory authority.
Most study material available online is GDPR-centric, and candidates transfer rules that differ in Kenya.
What to do instead
Anchor on the Data Protection Act and the Office of the Data Protection Commissioner: registration of data controllers and processors, lawful basis, data subject rights, restriction on cross-border transfers, and notification of breaches to the Commissioner within the period the Act prescribes. Where you are unsure of a specific period, state the obligation and flag the uncertainty rather than importing an EU figure.
Describing the securities settlement cycle, central securities depository arrangements or trading venue types in generic global terms rather than in terms of the Kenyan market.
Candidates learn market structure from international textbooks and never map it onto the Nairobi Securities Exchange, the central depository and the licensing of exchanges and over-the-counter arrangements under the Capital Markets Act.
What to do instead
Build a Kenyan market-structure diagram: who operates the exchange, who clears and settles, who holds securities in immobilised or dematerialised form, what counts as a licensed trading venue, and the role of the CMA in approving market rules. Answer settlement questions by reference to the depository and the prescribed cycle, not to a foreign default.
Ignoring the disclosure and continuing obligations side of listing and treating authorisation as the end of the regulatory story.
Candidates focus on the IPO approval gate and forget ongoing duties such as periodic reporting, price-sensitive announcements, directors' dealings and takeovers or mergers regulation.
What to do instead
Study the lifecycle: admission requirements, prospectus and disclosure standards, then continuing obligations including financial reporting, immediate disclosure of material information, restrictions on dealings by insiders, and the rules governing takeovers and significant shareholding changes.
Writing conduct-of-business answers that list broad principles such as fairness and integrity without naming the concrete duties: suitability and appropriateness, best execution, conflicts of interest management, complaints handling and disclosure of charges.
Principle-level language feels safe, but examiners award marks for the specific obligation and the mechanism that enforces it.
What to do instead
For each conduct topic, pair the principle with the operational duty and the evidence of compliance: client categorisation, suitability assessment and record, order handling and best execution policy, conflicts register and disclosure, fee and charge disclosure before the transaction, and a documented complaints process with escalation to the regulator or an ombudsman where applicable.