New law to require banks and payment providers to share customer data

The draft National Payment System Policy and National Payment System Bill, 2026 will require banks and service providers to create secure systems that protect data shared with third parties.

"Each payment service provider or payment system operator shall use systems that are capable of securely sharing customer data with third parties for open finance purposes,' the Act reads.

CBK believes the Act will promote market development, fair competition and transparency in the national payment system by allowing fintechs to reach more customers without owning their accounts after their consent.

"The Central Bank may require a payment service provider or payment system operator to implement a mechanism to securely share customer data with third parties after obtaining the customer’s consent."

Currently, banks and payment platforms like M-Pesa own and keep customer transaction data, but the new law will loosen the rigid mechanism of customer relationships.

Payment service providers or payment system operators will also have their operational licenses revoked if they fail to commence business within twelve months from the date the license is issued.

"Each license issued under this Act shall be subject to the condition that the licensee shall at all times maintain the minimum core capital prescribed under this Act and regulations," the Act adds.

The license suspension shall be for a period not exceeding six months "for reasons to be specified in writing by the Central Bank" and can be lifted upon fulfilment of penalties.

Committing an offence under the provisions of the Act will see individuals paying a fine not exceeding Ksh.3 million or imprisonment for a term not exceeding three years.

A repeat offence will attract a penalty of Ksh.5 million or imprisonment for a term not exceeding five years.

A corporate will be liable to a fine not exceeding Ksh.20 million, rising to Ksh.30 million in case of a repeat offence.

Each payment service provider and payment system operator will also be required to submit audited financial statements in respect of its activities in Kenya for a specified year not later than three months after the end of each financial year.

Members of the public have been invited to avail themselves for nationwide public participation conducted by the National Treasury and the CBK, and submissions should be made to CBK Governor Kamau Thugge by October 9.