The Central Bank of Kenya and the National Treasury published the draft National Payment System Bill, 2026 on 22 September, inviting feedback until 9 October and scheduling public forums in several towns.

The draft would replace the 2011 National Payment System Act and introduces a framework for “open finance”, requiring banks, mobile‑money operators and other payment providers to share customer transaction data with other licensed firms when the customer consents.

Two new licence categories are created: payment initiation service providers, which can trigger payments without holding funds, and account information service providers, which can aggregate data from multiple accounts for the user.

Capital and trust‑account requirements

The bill sets minimum capital thresholds for various payment‑service categories, ranging from KES 5 million for the new service providers to KES 250 million for electronic‑money issuers such as M‑PESA.

Electronic‑money issuers and wallet providers would be required to keep all customer balances in a trust account at a licensed bank, separate from the company’s operating cash, with safeguards that prevent seizure or loss in bankruptcy.

No single bank may hold more than KES 500 million or 25 % of a provider’s total trust funds, whichever is higher, to limit systemic risk.

Potential effects for consumers and fintechs

If implemented, fintechs could retrieve a user’s banking or mobile‑money data directly, eliminating the need for manual statement uploads and enabling more integrated budgeting, lending and payment‑initiation services.

The interoperability provisions also give the Central Bank authority to order payment providers to connect their systems, aiming to reduce fragmentation and lower transaction costs across the ecosystem.

Next steps and enforcement outlook

After the 9 October comment deadline, the Treasury will review submissions before moving the bill through Parliament; once enacted, existing payment firms will have one year to meet the new capital, trust‑account and data‑sharing requirements.

The Central Bank’s enforcement powers would be expanded, including the ability to issue warnings, suspend operations, levy fines up to KES 30 million for repeat breaches, and impose criminal penalties of up to seven years’ imprisonment for serious violations.