Digital Credit Provider (DCP) Licensing Compliance Checklist Kenya
1. Corporate Setup
| Task | Responsible Person | Deadline | Status (☐/✔) |
| Name approval with CBK & BRS | ☐ | ||
| Incorporate a Kenyan limited liability company | ☐ | ||
| Prepare Memorandum & Articles of Association (specify lending as object) | ☐ | ||
| Register for KRA PIN & tax obligations | ☐ | ||
| Open local bank account(s) | ☐ |
2. Central Bank of Kenya (CBK) – DCP Licence
| Task | Responsible Person | Deadline | Status (☐/✔) |
| Complete CBK-DCP-1 (Application Form) | ☐ | ||
| Complete CBK-DCP-2 (Fit & Proper) | ☐ | ||
| Complete CBK-DCP-3 (Personal Questionnaire) | ☐ | ||
| Provide Certificate of Incorporation (Kenya) | ☐ | ||
| Board resolution authorizing application | ☐ | ||
| Shareholding & Ultimate Beneficial Ownership (UBO) details | ☐ | ||
| Directors’/Senior Officers’ CVs, IDs, police clearance | ☐ | ||
| Audited financial statements or capital adequacy statement | ☐ | ||
| Business plan | ☐ | ||
| ICT/System description with assurance report | ☐ | ||
| Loan terms, pricing model & interest disclosure | ☐ | ||
| Consumer complaint handling procedure | ☐ | ||
| Telecom/platform agreements (USSD, app, aggregator) | ☐ | ||
| CRB agreements | ☐ | ||
| Policies (AML, Data Protection, Risk, Consumer, Governance) | ☐ | ||
| Pay KES 5,000 application fee | ☐ | ||
| Pay KES 20,000 licence fee (upon approval) | ☐ |
3. ODPC (Data Protection)
| Task | Responsible Person | Deadline | Status (☐/✔) |
| Register as Data Controller & Processor | ☐ | ||
| Data Protection & Privacy Policy | ☐ | ||
| Retention & Disposal Policy | ☐ | ||
| Cross-border Data Transfer Policy | ☐ | ||
| Privacy Notices for customers | ☐ | ||
| Data Protection Impact Assessment (DPIA) | ☐ | ||
| Appoint Data Protection Officer (DPO) | ☐ |
4. FRC – AML/CFT
| Task | Responsible Person | Deadline | Status (☐/✔) |
| AML/CFT Policy & Procedures | ☐ | ||
| KYC/CDD Policy | ☐ | ||
| Sanctions screening procedure | ☐ | ||
| STR/CTR reporting procedure | ☐ | ||
| AML/CFT Risk Assessment | ☐ | ||
| Record-keeping (≥7 years) | ☐ | ||
| AML Training for staff | ☐ | ||
| Register on goAML portal, file STRs/CTRs | ☐ |
5. CRB Compliance
| Task | Responsible Person | Deadline | Status (☐/✔) |
| Apply to access at least one licensed CRB | ☐ | ||
| Integrate API for credit reporting | ☐ | ||
| Notify customers 30 days before negative listing | ☐ | ||
| Credit Reporting Policy | ☐ |
6. Ongoing CBK Compliance
| Task | Responsible Person | Deadline | Status (☐/✔) |
| Pay annual licence renewal fee | ☐ | ||
| File annual returns & quarterly CBK reports | ☐ | ||
| Maintain complaint register | ☐ | ||
| Keep Board committees & policies updated | ☐ |
7. Key Policies Required
| Policy | Responsible Person | Deadline | Status (☐/✔) |
| AML/CFT Policy | ☐ | ||
| Data Protection & Privacy Policy | ☐ | ||
| Information Security Policy | ☐ | ||
| Consumer Protection & Disclosure Policy | ☐ | ||
| Credit & Collections Policy | ☐ | ||
| Risk Management Policy | ☐ | ||
| Complaints & Redress Mechanism | ☐ | ||
| Corporate Governance Policy | ☐ | ||
| Outsourcing/Third-Party Risk Policy | ☐ |
8. Typical Licensing Timeline
| Step | Deadline | Status (☐/✔) |
| Week 1–2: Name approval, Incorporation, KRA PIN | ☐ | |
| Week 3–5: Draft policies, ODPC registration | ☐ | |
| Week 6–8: Submit CBK application + ICT assurance | ☐ | |
| Week 9–12: CBK review + API testing | ☐ | |
| Week 12+: Licence approval | ☐ |
