5 critical questions about fintech compliance in Kenya answered

July 27, 2022
7 min read

Let’s face it, the past few weeks have been torrid for financial technology companies. Especially those playing in the cross-border payment space. Consequently, we have to take questions on fintech compliance mighty serious. Starting with the Kenyan market. 

Last week, we dove deep into the recent heat the Kenyan government has given Nigerian fintechs that have come under suspicion of money laundering. We learnt that these startups are using loopholes to move huge amounts of money globally against a tight regulatory terrain in Nigeria. The kind of loopholes that would likely arouse suspicions of money laundering. 

To summarise, this article shows that while money laundering could still be a distinct possibility, that should not be the only plausible narrative, pending when the Assets Recovery Agency (ARA) of Kenya completes its investigation. 

While we wait, it’s important that we understand fintech compliance in Kenya. How does the ARA work? How do you set up shop in the economic powerhouse of East Africa? 

We sought the help of Angela Kioi, Managing Partner, Kioi & Co.Advocates, with decades of experience in helping huge financial institutions stay compliant in Kenya, to help us answer some of these questions. 

What does fintech licensing look like in Kenya?

fintech compliance

The fintech landscape is vast and broad, and your regulatory regime could differ slightly from another fintech company playing in a different niche. Hence, founders would need to approach compliance. 

Firstly, every company, fintech included, needs to pay attention to policies and regulations from Kenya’s Ministry of ICT, the Competition Authority and the Office of the Data Protection Commissioner.

However, specific licensing regimes are under different regulatory agencies. 

The Central Bank of Kenya (CBK): Licenses companies traditional companies like banks, and financial technology companies playing in payments, loans, and mobile money. 

Be the smartest in the room

Join 30,000 subscribers who receive Techpoint Digest, a fun week-daily 5-minute roundup of happenings in African and global tech, directly in your inbox, hours before everyone else.
Digest Subscription

Give it a try, you can unsubscribe anytime. Privacy Policy.

The Capital Markets Authority: These include businesses doing anything related to investments, crowdfunding, and funds. 

The Insurance Regulatory Authority takes care of fintech products that offer insurance services to Kenyans. 

It’s important to note that depending on the products you offer, your regulations might involve more than one of these regulators. 

Niches like peer-to-peer lending marketplaces do not have clearly defined regulations, but it could easily involve any of these regulators depending on the situation. If it doesn’t, then our expert offers some insight

On another note, these licensing regimes have the responsibility to promote law and order and contribute information to bodies tasked with ensuring that criminals do not use the fintech space for criminal activities. One of such companies is the Ase

What is the ARA?

26683792493 9db306b205 b

The ARA is the body in charge of tracing, freezing, and confiscating the proceeds of crime in Kenya. Money gained from committing crimes like drug trafficking, human trafficking or Internet scams is either saved in bank accounts, or used to purchase assets like cars, gadgets, lands, or companies. 

Per Kioi, when there’s financial crime, evidence of a financial crime, or suspicion of financial crime, the ARA swoops in to recover those funds and make sure it gets to the right person. 

“Obviously they cannot just, you know, wake up in the morning and say, we want to freeze an account of person X, Y, and Z, without, justifiable cause. So they must be able to prove to the court before they can get a court order that there is evidence of something illegal that is going on, or that these are proceeds from some criminal activity.

“So in order to do that, obviously, they have to show what it is they suspect. Do they have documentation? Do they have suspicious movement of money? Do they have evidence of corruption or suspected corruption, and then they're able to then, um, get their orders and sell them onto their bank accounts? 

When do transactions get flagged? 

mtn ussd e1615941968215
||Panoramic view of Techpoint.Africa HQ

In several jurisdictions, when a suspicious amount of money enters an account, the bank usually freezes the money and invites the account holder to clarify. A similar scenario is also obtainable in Kenya’s financial system. 

Per Kioi, the Central Bank of Kenya (CBK) mandates banks to report any transaction above Ksh1 million ($8,420), and you would need to explain why you’re transferring such an amount of money into Kenya. 

“The ARA does not look into people’s bank accounts and say this looks suspicious. There has to be an original place where the suspicion has come from. Did it come from the banks? Did it come from the CBK? Or did it come from a whistleblower? Did the banks get an alert from banks outside Kenya? Or another investigating company outside of Kenya?”

When there’s any cause for suspicion, no one organisation acts in a vacuum, especially when it concerns cross-border transactions in Africa. 

A case in point is the recent case with Flutterwave, Korapay, and a host of other fintech companies that have reportedly attracted the attention of Interpol. Reports Interpol has refused to affirm or deny when queried by Techpoint. 

What happens if your accounts are frozen?


Once there’s cause for suspicion, the ARA, with the help of a court order, freezes the account as a first step to aid the investigation. The onus will now be on the company in question to prove or disprove the ARA or the CBK’s allegations. You can do this either through the courts or through the ARA itself. 

“Unfortunately, it looks like a very draconian action on their part, but at the same time, it's an action that they may feel is justified,” Kioi adds. However, she adds that if the company can show that some of these accounts were frozen unjustifiably, they could challenge this action. 

The ARA has an initial 45-day window to conduct an investigation on a frozen account. If it hasn’t gotten anything conclusive in that period, it can then file for an extra 90-days to continue the investigation.

How to approach fintech compliance? 

Photo by Iwaria via Iwaria.com

Fintech compliance is a tricky subject in any jurisdiction, but Kioi offers some interesting tidbits for fintech founders in Kenya to stay ahead of any regulatory upheavals that might come up in the long arduous journey of being a startup founder. 

Hire to stay compliant

Regardless of the regulatory framework, your fintech product falls under, you have to be compliant on all levels, and leave little room for suspicion.

“I know people come up with good ideas and say I want to do this and I think I can get the funding, and they go and get the funding and they start the business in Fintech space, but they need to find out how the space really works and comply,” Kioi states. 

However, this is easier said than done for most founders who have to deal with other aspects of the business that deal with marketing, customer retention, and the ever elusive product market fit. Regarding this, Kioi recommends that fintech founders must get good lawyers, accountants, and tax advisers in order to stay abreast with myriads of regulations that may come up. 

Banding together to Lobby 

Companies globally have long chosen the lobbying route to influence government decisions that would favour their business, and Kioi believes fintech companies who believe the space is not helpful should band together and try to influence the government, and the different government agencies they have to deal with. 

“It might take some time, but at least I think I've seen a lot of times when people bunch together and sit down and talk with the different government agencies, you might find that as long as what you say makes sense, you can then find a middle ground, and come up with new rules for the space that you're playing in to then enable that business.”

Avoid loopholes if you can

protect business idea without patent

We’ve pointed out that innovations always stay ahead of regulations, but regulations will always catch up. That was the spirit behind the article where we explored the good and the bad sides of regulations always catching up with innovations. 

Though startups regularly use loopholes to create exciting business opportunities, the government eventually catches up with these loopholes, and the outcome is rarely ever pleasant. In the fintech space, Kioi advises founders to limit their use of loopholes. 

“So you can't use loopholes hoping that you won’t be caught because if you're not compliant, then you just face the risk and compliance is one of those things I normally tell people. It is, or it isn't. You've either done it or you've not, there's no grey area in compliance.”

In less regulated niches, Kioi points out that lobbying the government early enough could help set the standard for the sector rather than waiting for them to catch up. 

“Even with organizations not registered in Kenya, coming into work in Kenya, coming in to work in Africa, wherever they may be registered is that you have to understand the laws of the land you're going into, and you have to comply. Once that is done, you can then start saying, actually, we can do this better and lobby for what it is that you want.”

The conversation on fintech compliance is wide and broad, and if you want me to go deeper, leave a comment for me on any of our channels. 

Journalist feasting on tech, business, and policies. Looking to chat? Catch up with me, @eruskkii, on Twitter or send a mail to emmanuel@techpoint.africa
Journalist feasting on tech, business, and policies. Looking to chat? Catch up with me, @eruskkii, on Twitter or send a mail to emmanuel@techpoint.africa
Subscribe To Techpoint Digest
Join thousands of subscribers to receive our fun week-daily 5-minute roundup of happenings in African and global tech, directly in your inbox, hours before everyone else.
This is A daily 5-minute roundup of happenings in African and global tech, sent directly to your email inbox, between 5 a.m. and 7 a.m (WAT) every week day! 
Digest Subscription

Give it a try, you can unsubscribe anytime. Privacy Policy.

Journalist feasting on tech, business, and policies. Looking to chat? Catch up with me, @eruskkii, on Twitter or send a mail to emmanuel@techpoint.africa

Other Stories

43b, Emina Cres, Allen, Ikeja.

 Techpremier Media Limited. All rights reserved