How to Get a PSP Licence in Kenya (2026)

Back to Insights

Every legal route into Kenya's payment services market — direct licence, partnership, JV, whitelabel, passporting & the moves nobody talks about.

If you're trying to launch payment services in Kenya, you've already figured out the regulator doesn't make it easy.

The Central Bank of Kenya (CBK) licences Payment Service Providers (PSPs) under the National Payment System Act. The Capital Markets Authority (CMA) has its own regime for securities-related fintech. And the Insurance Regulatory Authority (IRA) and Sacco Societies Regulatory Authority (SASRA) each have a say depending on what you're actually building.

Most founders Google "PSP licence Kenya" and find outdated blog posts written by people who've never read the CBK's licensing conditions. This guide is different. I've helped fintechs navigate every route on this list — the proper licences, the shortcuts, the partnership structures, and the strategies that work when you're not ready (or don't want) to carry a full licence yourself.

What's in this guide

Route 1: Direct PSP Licence from CBK

This is the full licence. It gives you the most control, the strongest market position, and the ability to build your own payment infrastructure from scratch. It's also the most expensive, the slowest, and the most heavily regulated path.

What the CBK requires

Minimum core capital of KES 50 million for non-bank PSPs (higher for specific categories)
Fit and proper testing for directors and significant shareholders
Detailed business plan with 3-year financial projections
Technology and cyber security framework documentation
AML/CFT policies, procedures, and reporting infrastructure
Proof of IT systems, data hosting arrangements, and business continuity plans
Consumer protection framework and complaint handling procedures

The reality check

CBK processing times have improved but expect 6–12 months from application to licence grant. The application fee is KES 25,000, but the real cost is in legal preparation, system documentation, compliance infrastructure, and the capital lock-up. Budget KES 5–15 million all-in for a clean application.

Common mistake: Founders submit incomplete business plans or try to copy-paste a foreign model. The CBK knows. Engage a regulatory lawyer early to structure the application properly — fixing a rejected application costs more than doing it right the first time.

PSP licence categories

The CBK distinguishes between different PSP types: money remittance, payment initiation, account information services, merchant acquisition, and switch operators. Your licence scope determines what you can and cannot do. Most fintechs apply too broadly (gets rejected) or too narrowly (limits growth). The scope needs to match your actual product roadmap.

Route 2: CMA Regulatory Sandbox

If your product touches securities, investments, or tokenized assets, the CMA's Regulatory Sandbox is your entry point. This isn't a PSP licence per se — it's a supervised testing environment where you can operate with relaxed requirements while proving your model.

Who this is for

Tokenized payment instruments or stablecoin structures
Investment platforms with payment components
WealthTech or Robo-advisory services with custodial elements
Any fintech where the payment service is bundled with a capital markets product

How it works

You apply to the CMA with a detailed testing plan, including participant safeguards, duration (typically 6–12 months), success metrics, and exit strategy. If approved, you operate under a "no objection" letter with specific limitations and reporting obligations.

The sandbox doesn't give you a permanent licence. The goal is to graduate either into a full CMA licence, a CBK PSP licence (if payment-led), or a tailored hybrid authorisation. Several fintechs have used the sandbox to prove traction before applying for full licences.

Strategic play: If your product has both payment and securities elements, you can sometimes use the CMA sandbox to defer the CBK PSP application while building market presence. But this requires careful legal structuring — the CBK and CMA don't always coordinate well, and operating in a gap between regulators is risky.

Route 3: Partnership with a Licenced PSP

This is the fastest route to market and the one most successful foreign fintechs use. Instead of building your own licence, you partner with an existing CBK-licenced PSP who carries the regulatory burden while you focus on product and distribution.

How the structure works

You sign a commercial partnership agreement with a licenced bank or PSP. They hold the customer funds, manage KYC/AML, handle regulatory reporting, and maintain the core licence. You provide the technology layer, customer interface, or distribution channel.

Partnership models that work in Kenya

Banking-as-a-Service (BaaS): A licenced bank provides account infrastructure, settlement, and compliance backbone. You build the front-end experience.
PSP referral partnership: You drive transaction volume; the licenced PSP processes and settles. Revenue share arrangement.
Technology licensing: You licence your platform to a bank or PSP who white-labels it. You get SaaS revenue; they get better tech.
Embedded finance partnership: For non-fintech businesses wanting to add payments — you integrate a licenced PSP's API into their product.

What to negotiate

The partnership agreement is where things go wrong. Key terms: exclusivity, revenue split, data ownership, IP rights, liability allocation, termination rights, and what happens to customers if the partnership ends. I've seen partnerships fall apart because founders didn't negotiate portability — when the deal ends, you lose your customers.

Regulatory risk: The CBK expects the licenced entity to maintain proper oversight of any partnership. If your partner cuts corners on compliance, both of you suffer. Do due diligence on your partner's regulatory standing before signing.

Route 4: Joint Venture with a Local Licence Holder

A JV goes deeper than a partnership. You're creating a new entity together, combining your technology or foreign brand with their licence and local market knowledge.

When a JV makes sense

You need the local partner's licence but want equity upside in the combined venture
The local market requires significant local knowledge (distribution, regulator relationships, hiring)
CBK or CMA has indicated preference for local participation in your sector
You have technology IP you want to protect through equity rather than licensing

Structuring considerations

Most JVs in Kenya are structured as limited liability companies with shareholding split between foreign tech partner and local licence holder. Critical decisions: who holds the licence (the JV entity or the local partner), board control, drag-along and tag-along rights, and exit mechanics.

The CMA may require specific disclosures for JVs involving foreign participants. The CBK generally doesn't restrict foreign ownership of PSPs but does apply fit-and-proper tests to all significant shareholders regardless of nationality.

Pro tip: Structure the JV so the licenced entity can continue operating if the foreign partner exits. Regulators hate structures where a licence becomes orphaned because the foreign partner pulled out.

Route 5: Whitelabel / Technical Service Provider

This is the lightest-touch option. You don't touch customer funds, you don't hold a licence, and you don't appear to the end user at all. You build the technology; a licenced entity puts their brand on it.

What you can do as a technical service provider

Build and maintain payment platforms, mobile apps, and web interfaces
Provide API infrastructure, payment gateways, and integration layers
Operate technical infrastructure (servers, security, uptime management)
Provide analytics, reconciliation, and back-office tools

What you CANNOT do

Hold customer funds or operate escrow accounts
Conduct KYC/AML verification (you can build the tool; the licenced entity must operate it)
Enter into direct contractual relationships with end customers
Appear as the service provider in customer communications

The commercial model

Typically fixed development fees plus ongoing SaaS-style maintenance and support fees. Revenue is predictable but capped — you don't participate in transaction volume upside the way a partnership or JV would allow.

Hidden risk: If you provide "technical services" but effectively control the customer relationship, the CBK may view you as a de facto PSP. Structure the arrangement carefully so the licenced entity maintains clear ownership of the customer relationship.

Route 6: Passporting & Cross-Border Arrangements

"Passporting" in the EU sense doesn't exist in Kenya. There's no automatic recognition of foreign fintech licences. But that doesn't mean cross-border structures don't work — they just require more creativity.

What works

Foreign entity with local agent: Your parent company holds a licence in another jurisdiction (UK, Mauritius, Singapore). You appoint a local agent in Kenya for marketing and customer support. The actual payment processing happens offshore; the local agent doesn't need a PSP licence if structured correctly.
Remittance corridor partnerships: If you hold a money remittance licence in the US, UK, or UAE, you can partner with a Kenyan PSP for the receiving end. This is how most international remittance fintechs operate in Kenya.
EBO (Extended Business Office): Some regulators allow foreign institutions to establish a representative office that doesn't conduct regulated activity directly but supports the parent company's local operations.

What doesn't work

Simply claiming your foreign licence covers Kenya — it doesn't
Using a "payment institution" licence from a lax jurisdiction to operate in Kenya — the CBK looks at substance, not just paperwork
Attempting to serve Kenyan customers from offshore without any local presence or partnership — this gets shut down fast

Key insight: The CBK has become increasingly attentive to "regulatory arbitrage" — fintechs choosing weakly regulated jurisdictions and trying to serve Kenya from there. If you're building substance offshore, make sure it's genuine substance (real office, real staff, real compliance) not just a PO box licence.

Route 7: Agent Network Model

If your business model is about distribution — reaching customers in areas where banks don't exist — the agent model is worth understanding. You don't need a PSP licence to be an agent; you need a principal who has one.

How it works

A licenced bank or PSP appoints you as their agent. You conduct cash-in/cash-out, customer onboarding, and basic customer service under their licence and supervision. You earn commissions on transactions.

Scaling beyond pure agency

Smart fintechs start as agents, build a distribution network, then use that leverage to negotiate a partnership or JV with their principal. When you control 10,000 agents, you have negotiating power. When you have zero, you don't.

Regulatory notes

The CBK's Agent Banking Guidelines set out detailed requirements for agent eligibility, due diligence, transaction limits, and reporting. Your principal is responsible for your conduct, so expect tight oversight.

Route 8: Innovation Lab & Accelerator Structures

The NSE Innovation Lab, iHub, and various bank-led innovation programmes offer a soft landing for fintechs. These aren't licences, but they provide regulatory air cover, mentorship, and sometimes a pathway to formal authorisation.

What you get

Working space and technical infrastructure
Mentorship from industry executives and sometimes regulators
Introductions to potential partners and investors
A "regulatory safe harbour" environment where you can test without full licensing

What you don't get

A licence. You still need one of the routes above to go live at scale. But the Lab environment can buy you 6–12 months to build product, demonstrate traction, and prepare a proper licence application with regulator visibility.

Strategic value: The NSE Innovation Lab in particular has strong CMA relationships. If your product has securities-adjacent elements, graduating from the Lab gives you a regulatory story that makes your formal application smoother.

Route 9: Special Limited Purpose Vehicles

For complex structures — especially securitisation, tokenization, or pooled investment products — a Special Purpose Vehicle (SPV) may be the right container. This is advanced structuring and requires specialised legal work.

When you need an SPV

Tokenizing real-world assets with payment distribution mechanisms
Securitising receivables where payment collection is part of the structure
Ring-fencing customer funds from operational entity risk
Creating bankruptcy-remote structures for investor protection

The regulatory overlap

An SPV itself doesn't replace a PSP licence. If the SPV handles payments, it still needs CBK authorisation or must operate through a licenced PSP. The SPV is a structural tool, not a regulatory shortcut.

Quick Comparison: All 9 Routes

Route	Time to Market	Capital Required	Control Level	Best For
Direct PSP Licence	6–12 months	High (KES 50M+ core capital)	Full	Scale players, proven models
CMA Sandbox	3–6 months	Medium	Moderate (with limits)	Securities-adjacent fintechs
PSP Partnership	1–3 months	Low-Medium	Shared	Foreign entrants, MVPs
Joint Venture	3–6 months	Medium	Shared (negotiated)	Strategic market entry
Whitelabel/TSP	1–2 months	Low	Low (you're invisible)	Tech vendors, infrastructure
Cross-Border	2–4 months	Medium	Moderate	Remittance, global fintechs
Agent Model	1–2 months	Very Low	Low	Distribution-first models
Innovation Lab	1–2 months (to enter)	Low	Low (temporary)	Early-stage, testing phase
SPV Structure	3–6 months	Medium-High	High (for asset)	Tokenization, securitisation

How to Choose Your Route

I've walked enough fintechs through this to know the decision framework. Here's how to think about it:

If you have time but limited capital

Start with the CMA Sandbox or NSE Innovation Lab. Build proof points, then graduate to a full licence or negotiate from a position of strength.

If you have capital and want maximum control

Go for the Direct PSP Licence. It's the longest and most expensive route, but it gives you an asset that increases in value as the market consolidates.

If you're foreign and need speed

PSP Partnership or JV. Most successful foreign fintechs in Kenya (Chipper Cash, Eversend, others) used partnerships with local banks or PSPs before applying for their own licences.

If you're a tech platform, not a financial services brand

Whitelabel / TSP route. Let someone else hold the licence and the regulatory risk. Focus on building the best technology.

If you're building something genuinely new

Sandbox first. Regulators are more open to innovation when they can watch it closely. The sandbox gives you that channel and builds trust before you ask for a full licence.

FAQ

How long does a CBK PSP licence take?

6–12 months from a complete application. Incomplete applications get sent back, which resets the clock. Get the application right the first time.

Can a foreign company hold a PSP licence in Kenya?

Yes. The CBK doesn't restrict foreign ownership of PSPs. But directors and significant shareholders must pass fit-and-proper tests, and having local directors strengthens the application.

What's the difference between CBK and CMA licensing?

CBK regulates payment services — moving money. CMA regulates securities and investments — capital markets activity. If your product does both (e.g., a payments app with an investment feature), you may need both. That's where the sandbox or hybrid authorisation becomes useful.

Can I operate while my application is pending?

No. Operating a payment service without a licence is an offence under the National Payment System Act. The CBK has issued public warnings and taken enforcement action against unlicensed operators.

What happens if my application is rejected?

You can reapply, but address the specific reasons for rejection. The CBK provides feedback. A lawyer who understands their concerns can help restructure and resubmit.

Is whitelabelling risk-free?

No. If you're the effective controller of the service, the CBK may still regulate you. Structure the arrangement so the licenced entity genuinely manages the customer relationship, compliance, and risk.

Does Kenya recognise EU or US fintech licences?

No automatic recognition. But a strong licence from a reputable jurisdiction (UK FCA, US state money transmission licences, Singapore MAS) strengthens your CBK application and may speed up the fit-and-proper assessment.

There is no single "best" route into Kenya's payment services market. The founders who win are the ones who pick the structure that matches their stage, resources, and ambition — and who get the legal architecture right from day one.

I've seen brilliant fintechs stall for 18 months because they chose the wrong entry route. I've seen others go live in 6 weeks with a well-negotiated partnership. The difference isn't luck — it's strategic legal planning.

Pick your route. Build it properly. Execute fast.

FINTECH, PSP,MRP,VASP,DCP Fintech Africa Regulatory Advisory