KYC Compliance for Fintechs in Kenya: CMA Requirements and Digital Identity Verification

KYC compliance for fintechs in Kenya is a legal requirement enforced by the Capital Markets Authority (CMA), the Central Bank of Kenya (CBK), and the Financial Reporting Centre (FRC) under the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) 2009 and the AML/CTF Amendment Act 2025.

Fintechs operating in Kenya's capital markets and digital finance ecosystem must verify customer identity, conduct risk-based due diligence, screen for politically exposed persons (PEPs), and report suspicious transactions, or face criminal penalties, licence suspension, and reputational damage.

KYC Compliance in Kenya: Why Fintechs Face a Different Regulatory Reality

Kenya's fintech sector is not regulated by a single supervisor. The regulator you answer to depends on the product you offer.

A digital lending platform answers to the CBK under the Central Bank of Kenya Act and the Digital Credit Providers Regulations 2022. An investment app, robo-advisor, or crowdfunding platform answers to the CMA under the Capital Markets Act, Cap 485A. A crypto exchange or VASP is now subject to dual oversight by both the CBK and the CMA under the VASP Act 2025. Each regulator applies the same overarching POCAMLA framework, but adds its own sector-specific KYC layer on top.

This is the compliance reality that separates fintech KYC from bank KYC in Kenya. The obligations are layered, not flat.

The stakes are rising. Kenya remains on the FATF grey list as of April 2026, and both the CBK and CMA are under international pressure to demonstrate enforcement effectiveness. Fintechs that built their products during Kenya's earlier era of light-touch oversight are now facing structured audits and real licence risk.

Read our guide on KYC and POCAMLA Compliance in Kenya: Requirements and Guidelines

Who Regulates Fintech KYC in Kenya? CBK vs CMA vs FRC

Before you can build a KYC programme that works, you need to know which regulator owns your compliance.

All of the above also report suspicious transactions to the Financial Reporting Centre (FRC), which functions as Kenya's financial intelligence unit under POCAMLA. (The POCMLA and FRC reporting obligation)

The practical consequence: a fintech in Kenya may hold multiple licences and must satisfy multiple KYC frameworks simultaneously. A VASP that also processes payments, for example, is accountable to both the CBK and CMA, and must map its KYC programme to both regulatory expectations.

CMA Kenya KYC Requirements for Fintechs: What the 2025 Regulations Require

The Capital Markets (Licensing Requirements) (General) Regulations 2025 represent the most significant overhaul of Kenya's capital markets compliance framework since 2002. For fintechs, the implications are direct and immediate.

What Changed Under the CMA Kenya 2025 Regulations

The 2025 Regulations expanded the licensing perimeter to explicitly capture digital distribution platforms, robo-advisors, and alternative trading systems that previously operated in a grey area. According to legal analysis published by Mboya Wangongu and Waiyaki Advocates in April 2026, the regulations shift to a more intrusive, risk-based supervision model.

New licensing categories introduced or formalised under the 2025 Regulations include:

• Broker-dealers: digital platforms executing securities transactions
• Robo-advisors: algorithm-driven investment advisory services (Regulation 14 mandates a Kenya-based principal bank account and adequate capital)
• Intermediary Services Platforms (ISPs): platforms partnered with licensed market intermediaries, now required to hold their own CMA licence
• Custodians: restricted to CBK-licensed banks with demonstrated custodial capacity

Each of these categories carries a mandatory KYC and AML obligation as a condition of both licensing and continued market access.

Related: Anti-Money Laundering Act Kenya

What are the CMA Kenya KYC Core Requirements?

For any fintech regulated by the CMA, the following KYC obligations apply:

1. Customer Identification and Verification:

Verify every customer's full legal name, date of birth, national ID or passport number, and physical address. For corporate clients, verify company registration, directors, and Ultimate Beneficial Owners (UBOs), now mandatory under the 2025 Amendment Act. Verification must be cross-referenced against government databases, not just document scans.

2. Risk-Based Customer Due Diligence (CDD):
 

Assign a risk score to every customer based on profile, source of funds, jurisdiction of origin, and transaction patterns. Low-risk customers require standard CDD. High-risk customers, including PEPs and non-residents, require Enhanced Due Diligence (EDD) with senior management approval before onboarding proceeds.

3. PEP and Sanctions Screening:
 

Screen every customer and UBO against global PEP lists, OFAC sanctions, UN sanctions, and domestic watchlists before onboarding. Screening cannot be a one-time event. The CMA and FRC expect continuous monitoring, with screening refreshed whenever customer risk status changes.

4. Ongoing Transaction Monitoring:

Monitor customer transaction patterns for deviations that signal money laundering, terrorism financing, or market manipulation. Flag and investigate anomalies. For CMA-regulated fintechs, transaction monitoring must also account for securities-specific risks such as insider trading, layering through investment accounts, and rapid asset movement inconsistent with the customer's declared investment profile.

5. Suspicious Transaction Reporting (STR):

File STRs with the FRC promptly when suspicious activity is detected. Under the 2025 Amendment Act, delays in STR filing are treated as non-compliance, not procedural lapses.

6. Record Keeping:

Maintain all KYC files, due diligence records, and transaction logs for a minimum of seven years, per POCAMLA Section 11.

CMA Regulatory Sandbox: KYC Still Applies

Fintechs admitted to the CMA Regulatory Sandbox, established in 2019 under the Capital Markets Act, do not receive an exemption from KYC obligations. Per the Chambers and Partners Fintech Guide 2025, once onboarded to the sandbox, fintechs must adhere to minimum regulatory requirements applicable to all capital market participants, including AML, counter-terrorism financing (CTF), and related obligations. Operating in the sandbox reduces product approval friction, not compliance obligations.

KYC Requirements for VASPs Under the Kenya VASP Act 2025

The Virtual Asset Service Providers Act 2025, passed by Kenya's Parliament on 7 October 2025, brought cryptocurrency exchanges, custodial wallets, and digital asset brokers under mandatory KYC regulation for the first time.

Under the VASP Act:

• VASPs are licensed by the CMA for capital markets activities and by the CBK for payment-related services, creating a dual-regulator model
• VASPs must implement digital KYC, real-time transaction monitoring, and periodic risk assessments
• VASPs are subject to both on-site and off-site regulatory inspections
• An annual compliance audit must be submitted to the CMA
• A Consumer Protection Code applies to all VASP customer interactions
• AML and CTF obligations are consistent with POCAMLA

This is a material shift. Before the VASP Act, crypto fintechs in Kenya operated in a largely unregulated environment. The 2025 Act eliminates that space entirely. Any VASP that fails to apply for a licence within six months of the Act's commencement date faces unlicensed operation penalties under the Capital Markets Act.

Digital Identity Verification for Kenyan Fintechs: The Technical Requirements

Knowing what to verify is the first part of KYC compliance for fintechs in Kenya. Knowing how to verify it to a regulatory standard is the second part, and it is where many fintechs fall short.

1. Government Database Verification

Kenya's identity verification infrastructure is anchored in two primary systems:

• IPRS (Integrated Population Registration System): The central government database for all citizen identity records. Verification against IPRS confirms that a National ID or Maisha Card is genuine, active, and belongs to the individual presenting it. Direct API access to IPRS is the gold standard for fintech KYC in Kenya.
• eCitizen: Kenya's government services portal, used to verify a range of documents including KRA PIN, driver's licence status, and business registration records.
• BRS (Business Registration Service): Used for corporate KYC, confirming company registration, directorship, and beneficial ownership structures.

2. Maisha Namba and the Maisha Card

Kenya's Maisha Namba digital identity ecosystem, launched progressively from 2024, is the most consequential development for fintech KYC since M-Pesa.

Unlike the traditional National ID, which was issued at age 18 and isolated from other government systems, Maisha Namba is:

• Lifecycle-based: assigned at birth and activated on the Maisha Card at age 18
• Interoperable: designed to function across banking platforms, public registries, and fintech APIs
• IPRS-linked: all records connect directly to the Integrated Population Registration System
• Fraud-resistant: replaces the fragmented system of National ID, Huduma Namba, and birth certificates with a single verifiable reference

For fintech compliance teams, Maisha Namba enables more reliable automated verification and reduces impersonation risk. Fintechs that integrate with the Maisha Namba API early will hold a meaningful operational advantage in customer acquisition speed and compliance robustness.

Understand the full details on the new Kenyan Maisha Card

3. Biometric Verification and Liveness Detection

The CBK and FRC require biometric-grade verification for digital account opening. For CMA-regulated fintechs, the same standard applies. Biometric verification involves two steps:

• Facial recognition: matching the customer's live selfie against the photo embedded in their identity document
• Liveness detection: confirming the person is physically present, not a photograph, deepfake, or pre-recorded video

Liveness detection is not a nice-to-have feature. It is a regulatory requirement for digital onboarding under Kenya's eKYC framework. 

Fintechs that skip biometric verification create both identity fraud exposure and direct regulatory non-compliance. 

In early 2023, around 26% of ID verification attempts in Kenya were flagged as fake or stolen, the highest rate in East Africa. That number signals what happens when biometric controls are absent.

4. OCR and Document Authenticity Checks

For digital onboarding, Optical Character Recognition (OCR) reads the Machine-Readable Zone (MRZ) of identity documents and compares the extracted data against government database records. This dual check, document authenticity plus live database match, is what distinguishes compliant digital KYC from basic document collection.

Fintechs must verify that the document is genuine and that the information on it matches government records in real time. Storing a document image without cross-referencing IPRS does not meet the verification standard under POCAMLA or CMA requirements.

Kenya Data Protection Act 2019: The Compliance Layer Fintechs Miss

KYC data collection without data protection compliance creates a second category of regulatory exposure.

The Kenya Data Protection Act (DPA) 2019 applies to every fintech that collects, processes, or stores customer personal data, which is all of them. The DPA requires that:

• Personal data is collected for a specific, lawful purpose and not used beyond that purpose
• Data is stored securely and protected against unauthorised access
• Customers are informed of how their data will be used
• Data is retained only for as long as necessary, with KYC records subject to POCAMLA's seven-year minimum

The Data Commissioner can investigate, impose corrective orders, and impose fines for DPA violations. Fintechs that build KYC systems without privacy-by-design principles will face dual exposure: POCAMLA penalties for KYC failures and DPA penalties for data handling failures.

Consequences of KYC Non-Compliance for Fintechs in Kenya

The enforcement landscape has hardened. With Kenya still on the FATF grey list, the CBK and CMA have been under international pressure to demonstrate credible enforcement since 2023.

Beyond financial penalties, non-compliant fintechs face the following consequences:

• Loss of correspondent banking relationships: international banks apply heightened due diligence to institutions with weak AML controls, effectively making cross-border payments operationally impossible
• CMA licence withdrawal: fintech platforms regulated by the CMA risk losing their licence to operate in Kenya's capital markets entirely
• Asset Recovery Agency action: the ARA can freeze accounts and seize assets where money laundering is suspected
• Reputational damage: public enforcement actions by the FRC or CMA destroy the investor confidence that fintech valuations depend on

How Youverify Helps Fintechs Meet Kenya's KYC and CMA Compliance Requirements

The compliance challenge for Kenyan fintechs is not understanding what KYC requires. Most compliance teams know the rules. The challenge is executing those requirements at scale, across a mobile-first, high-volume onboarding environment, without slowing down customer acquisition or creating manual review backlogs that expose the business to ongoing risk.

Youverify delivers an API-first KYC and AML compliance infrastructure built for exactly this environment.

Here is what Youverify provides for Kenya-regulated fintechs:

• IPRS, eCitizen, and BRS verification: Direct API access to Kenya's government databases, covering National ID, Maisha Card, Passport, Driver's Licence, Alien ID, and KRA PIN in real time, with 36M+ Kenyan records covered
• Biometric Liveness Detection: Confirm the customer submitting documentation is physically present, blocking deepfake and impersonation attempts that account for a significant share of Kenya's identity fraud
• AI-Powered Transaction Monitoring: 100+ pre-built rules aligned to Kenya's AML typologies, with customisable thresholds and intelligent case prioritisation that reduces false positives by more than 50%
• PEP and Sanctions Screening: Real-time screening against global PEP lists, OFAC, UN sanctions, and adverse media, refreshed continuously and not just at onboarding
• KYB with UBO Verification: Automatically surface the beneficial ownership structures of corporate clients and flag hidden risks, critical for CMA's 2025 Regulations and the VASP Act's UBO requirements
• Automated STR and CTR Workflows: Generate compliant case documentation and file reports with the FRC within POCAMLA's required timeframes without manual intervention
• eKYC for Mobile and Agent Networks: Optimised for Kenya's low-bandwidth mobile environment, enabling compliant remote onboarding through fintech apps and agent networks.

Youverify clients report a 60%+ reduction in fraud losses, 90%+ faster onboarding, and 50%+ fewer false positives, while maintaining full POCAMLA, CMA, FRC, and CBK compliance.

Book a demo with our KYC compliance analysts

About the Author

Temitope Lawal is a RegTech and compliance specialist at Youverify. She has written for fintech companies and financial institutions across Nigeria and international markets, with a research focus on AML compliance, fraud prevention, and financial crime regulation. Her work covers regulatory developments from the FCA, NCA and FATF, and is informed by ongoing engagement with primary compliance sources and industry research.