How to Spot an Unlicensed Loan App in Kenya (2026)

Since 2022, digital lenders in Kenya must be licensed by the Central Bank of Kenya as Digital Credit Providers (DCPs). Licensed lenders follow rules on pricing disclosure, debt-collection conduct and what they may do with your data. Unlicensed apps follow none of them — and Kenya learned the hard way what that looks like: contact-list shaming, harassment calls to family and employers, and "processing fees" for loans that never arrive.

Here is how to check any app in two minutes, and the red flags that should end the conversation immediately.

The register is big now — use it

The CBK has licensed in batches since March 2022, working through more than 800 applications. After the July 2026 batch the register stands at about 252 licensed DCPs.

That number matters for a practical reason: with 252 licensed options, there is no legitimate reason to borrow from an unlicensed app. The old excuse — "the licensed ones wouldn't lend to me" — is far weaker than it was. If nobody on a 252-name list will lend to you, an unlicensed lender is not the answer to that problem.

The two-minute licence check

Open the CBK's register of licensed Digital Credit Providers on centralbank.go.ke. The CBK publishes it as a dated directory.
Search for the exact legal name. Apps trade under brand names; the register lists companies, and one company may run several apps. Find the legal entity in the app's About page or terms, then match it.
Check the directory's "as at" date — batches are added regularly, so a very new app might be legitimately pending. Pending is not licensed.
Not on the list? Don't borrow. It is operating outside the law that exists specifically to protect you.

One exception to know: bank-backed products such as M-Shwari, KCB M-Pesa and Fuliza run under their partner banks' own CBK licences rather than the DCP register. They are regulated, under a different rulebook — see Fuliza explained. Likewise SACCO loans fall under SASRA.

Red flags that end the conversation

Upfront fees. Any "processing", "verification", "insurance" or "unlock" fee demanded before disbursement is the classic advance-fee scam. Licensed lenders deduct disclosed fees from the loan; they never ask you to pay first. If you remember one rule, make it this one.
Contact-list or gallery access as a condition. The Digital Credit Providers Regulations and the Data Protection Act prohibit debt-shaming through your contacts. An app that insists on your phonebook intends to use it. There is no lending reason to read your photos.
No total cost shown before you accept. Licensed DCPs must disclose the full charge. "You qualify for KSh X, tap yes" with the cost in fine print is a conduct breach and a preview of the collection style.
A rate quoted only per day. "Just 1% a day" is roughly 365% a year before compounding. Daily quoting exists to hide the annual number.
Pressure and countdown timers. "Offer expires in 10 minutes" is not how regulated credit works.
Repayment to a personal M-Pesa number rather than a paybill in the company's name.
No physical address or legal name anywhere in the app or on its site.

If you're already caught

Harassment or contact-shaming: report to the Office of the Data Protection Commissioner (ODPC), which has enforcement powers over how lenders handle personal data, and to the CBK for conduct breaches. Both publish current complaint channels on their official sites.
Warn your contacts first. The tactic works through embarrassment. A short message explaining that a loan app has your contacts and may send lies about you removes most of its power before it starts.
Threats: debt collection by threat is unlawful regardless of whether the debt is real. Keep evidence — screenshots, call logs, messages sent to third parties.
Revoke permissions and remove the app, then review what other apps hold contact and storage access. Uninstalling does not delete what was already copied, so treat it as a data breach.
The debt itself: an unlicensed lender operating illegally has limited lawful means to enforce. Get advice before paying anyone who is threatening you into it — and never pay a "release fee" to stop harassment. Paying is the scam's second act, not the end of it.

What "licensed" buys you (and what it doesn't)

A DCP licence means the CBK vetted the lender, its pricing must be disclosed, and its conduct is answerable to a regulator you can reach. It also means it reports to the credit reference bureaus, so repaying well builds a usable file.

It does not mean the loan is cheap. Kenya has no interest-rate cap on digital credit, and licensed digital credit is still expensive credit — the CBK's own reporting shows licensed DCPs have issued millions of loans worth well over KSh 150 billion, at prices that only look small because the tenors are short.

Compare the total repayable, not the daily-rate marketing. Check any lender against the CBK-licensed digital lenders list, compare licensed personal loans, and if the amount is small and short, check whether the Hustler Fund at 8% a year covers it first — because almost nothing commercial will beat that.

Frequently asked questions

How many loan apps are licensed in Kenya? About 252 Digital Credit Providers after the July 2026 batch. Check the CBK's dated directory for the current figure.

Does checking an app's Play Store rating help? No — ratings are farmed. The CBK register is the only check that matters.

Is Fuliza on the DCP register? No — it is bank-underwritten credit under the partner banks' own CBK licences, which is a different rulebook, not an absence of regulation.

What does a CRB listing mean? Licensed lenders report through credit reference bureaus, so repayment history affects your future borrowing. Unlicensed apps threatening to "CRB you" are usually bluffing — check your own record through the bureaus' official channels, see how to check your credit score in Kenya.

Can a loan app legally contact my family about my debt? No. Debt-shaming through your contacts breaches the Digital Credit Providers Regulations and the Data Protection Act, and is grounds for a complaint to the ODPC — whether or not the lender is licensed.