That loan app just called your mother. Here is what the law says about that.

By Ibalai Vallary | Founder of Ibalai Legal

What Kenyan borrowers need to know about digital lending, debt shaming and the rights they
never knew they had.

Your phone buzzes during dinner. It is not your bank. It is your aunt in Nakuru, voice shaking: “Someone called me. They said you owe money. They said you will be arrested. They read me your loan balance down to the last shilling.”

You did not give them her number. You never listed her as a reference. But the moment you installed that loan app and tapped allow on the contacts permission, you handed over your entire phonebook.

And now your family is paying the price for a loan approved in under three minutes. This is not an edge case. This is standard operating procedure for Kenya’s predatory digital lenders. And as of 2025, it is finally, explicitly, criminal.

How did we get here?

Kenya’s digital lending boom was built on genuine need. Millions locked out of traditional banking by lack of collateral or a formal pay slip needed credit. Digital lenders filled that gap with quick approvals and instant M-Pesa disbursements. But the absence of regulation turned that lifeline into a trap. Before 2022, digital credit providers operated almost entirely outside the law no licensing, no conduct rules, no accountability. Borrowers had almost nowhere to turn.

The Central Bank of Kenya (Amendment) Act, 2021

For the first time, digital credit providers were brought under CBK supervision. Operating without a CBK licence is now a criminal offence punishable by up to three years imprisonment or a fine of Ksh 5 million. The number of licensed providers has grown steadily from 32 at the first licensing round in 2022, to 126 by late 2024, and 227 as of April 2026 (CBK, Digital Credit Providers Register, 2026  centralbank.go.ke/digital-credit-providers). Every lender outside that list is breaking the law.

The CBK (Digital Credit Providers) Regulations, 2022

These regulations explicitly prohibit contacting a borrower’s family or employer about their debt, using threats in debt collection, accessing contacts without informed consent, and disclosing loan information to third parties (CBK DCP Regulations, 2022, Regulation 14). Non-compliance risks fines of up to Ksh 500,000 or licence revocation.

The Business Laws (Amendment) Act, 2024, In Force January 2025

This Act elevated debt harassment from an administrative infraction to a criminal offence. Before 2025, lenders faced administrative fines. Now they face criminal liability and licence suspension (Business Laws (Amendment) Act, 2024, s.3).

The Data Protection Act, 2019

Using your contacts without consent is a data protection violation. The ODPC can impose fines of up to Ksh 5 million (Data Protection Act, 2019, s.65). In 2025, at least one lender was fined Ksh 2 million specifically for sharing borrowers’ contact information. If a debt collector contacted your family or employer without your explicit consent, they have almost certainly violated multiple laws simultaneously.

What the courts have said

Mulla Pride Limited v Office of the Data Protection Commissioner [2025] KEHC 11287
(KLR)

This case confirmed that the ODPC is not a toothless regulator but it also shows that the process of challenging its decisions matters. Mulla Pride, a digital lender sanctioned by the ODPC, took the wrong route to court. Instead of using the statutory appeal mechanism under Section 64 of the Data Protection Act, it filed a constitutional petition. The court dismissed this as an abuse of process, the correct challenge route is the statutory appeal, not a constitutional back door. The ODPC’s enforcement decisions stand until properly challenged through the right channel. The practical message: if a loan app has misused your data, file with the ODPC at complaints.odpc.go.ke.

M-Collect Limited & Others v Borrowers [2025] (SCCOMM/E9994/2025)

Six unlicensed digital lenders; Aventus Technology, Kalita, Garnet, Sirius, M-Collect and Maxlev had collectively filed 139 debt recovery cases against borrowers in Kenyan courts. The court dismissed all 139 in a single ruling, holding that it could not dignify an illegality by presiding over such matters. An unlicensed lender cannot invoke the court system to enforce a debt because doing so would require the court to enforce an illegal contract. The ruling is accessible via CM Advocates’ case summary at cmadvocates.com.

Debt Shaming Damages and the In Duplum Rule

Kenyan courts have awarded damages to borrowers whose lenders weaponised their social networks calling relatives, disclosing loan balances and orchestrating public humiliation. These awards are grounded in Article 28 of the Constitution (inherent dignity) and Article 31 (right to privacy).

Reported awards have ranged from Ksh 250,000 to Ksh 700,000, though the specific case citations remain in the lower court records and have not yet been published on Kenya Law’s public database. If you are experiencing debt shaming, document the conduct and consult an advocate there is a clear legal basis for a claim. Separately, a 2025 ruling extended the in duplum rule to digital lenders, capping total interest at the amount of the original loan. If you borrowed Ksh 5,000, the maximum you can ever owe in interest is Ksh 5,000 regardless of penalties added.

The tactics you should recognise

The moment you tap allow on contacts, your phonebook becomes a harassment list. Agents call your family, disclose your balance, and falsely threaten arrest calculated humiliation designed to make your network pressure you into paying. They offer loan extensions that are simply new, more expensive loans. And critically: defaulting on a digital loan is not a criminal offence.

On CRB listings: a Credit Reference Bureau (CRB) is a database used by lenders and banks to check a borrower’s credit history before approving loans. A negative CRB listing can block you from accessing credit across Kenya. The CBK expressly prohibits negative CRB listings for defaults below Ksh 1,000 (CBK DCP Regulations, 2022, Regulation 19). If you have been negatively listed for a small default, you can dispute it directly with TransUnion (transunion.co.ke) or Metropol (metropol.co.ke)

What you can do

1. Check if your lender is CBK licensed. Go to centralbank.go.ke/digital-credit-providers. Search for your lender’s name. If they are not listed, they are operating illegally and cannot enforce any debt against you in court. You can also call the CBK toll-free consumer helpline on 0800 723 044 to verify licence status.
2. Document everything. Screenshot every message. Record call details time, number, what was said. Save your loan agreement and repayment records. Evidence is the foundation of every complaint and court claim
3. File a complaint with the CBK. For harassment, contact shaming, or unfair practices by a licensed lender: email consumerprotection@centralbank.go.ke or call 0800 723 044
4. File a complaint with the ODPC. For unauthorised use of your contact data: complaints.odpc.go.ke. Fines of up to Ksh 5 million apply.
5. Consider a court claim. Debt shaming awards have ranged from Ksh 250,000 to Ksh 700,000. Mediation resolves most cases within 3–6 months. Consult a qualified advocate for your specific situation.

The bottom line

The exploitation that defined Kenya’s digital lending sector the debt shaming, the contact harvesting, the false threats was never legal. It was simply unchecked. The CBK (Amendment) Act, the 2022 Regulations, the Data Protection Act, and the Business Laws (Amendment) Act 2024 together give
Kenyan borrowers a comprehensive legal toolkit.

The question is whether borrowers know those tools exist. Now you do.

 

 

REFERENCES

1. CBK Licensed Digital Credit Providers Register (2026): centralbank.go.ke/digital-credit-providers 
2. CBK (Digital Credit Providers) Regulations, 2022 — full text: Central Bank of Kenya
3. Business Laws (Amendment) Act, 2024 — analysis: Mukamba & Company Advocates
4. Mulla Pride Limited v ODPC [2025] KEHC 11287 (KLR): Kenya Law Reports
5. M-Collect & Others — 139 cases dismissed (SCCOMM/E9994/2025): CM Advocates
6. Business Daily Africa – Debt-shaming back as digital lenders defy CBK
7. Nairobi Wire – CS Mbadi Moves to End Debt-Shaming by Predatory Digital Loans
8. Manwa OH Advocates – Legal Protections for Consumers in Unfair Lending Practices
9. Muma & Kanjama Advocates – The Hidden Costs of Digital Lending 

 

 

Ibalai Legal is a Nairobi-based online legal practice on a mission to make law accessible to every Kenyan. Through Be In The Know With Ibalai Legal, we break down complex legal concepts into clear, practical content for individuals, startups and SMEs. 

 

Catch you in the next blog!

 

Disclaimer- The information provided is for general informational purposes only and should not be considered as professional advice. Please consult a qualified professional for specific guidance.