When a business needs CBK payment authorisation
When a Kenyan business that collects or moves money for others may need Central Bank authorisation as a payment service provider, and the offences.
By Achekam · · 4 min read · For Running a business businesses in Kenya
Most businesses collect money only for themselves: a customer pays for goods or services, and the money is the business's own. Some business models drift beyond that. A marketplace takes payment from buyers and pays sellers. An app lets its users send money to each other. A platform collects on behalf of many small merchants and settles with them later.
Once a business starts moving money for other people, a question arises that many founders do not ask until late: is this the business of a payment service provider, and if so, does it need the Central Bank of Kenya's authorisation? This article sets out what the National Payment System Act says, how authorisation works, and where the lines are drawn. Where your own model sits is a legal question to take to an adviser or to CBK.
The authorisation rule and the offence
Section 12 of the National Payment System Act, 2011, as consolidated on Kenya Law, says no person may conduct the business of a payment service provider in Kenya unless authorised. Doing so is an offence punishable by a fine of up to five hundred thousand shillings or up to three years' imprisonment.
The Central Bank describes the categories it works with: provision of electronic retail transfers, small money issuer, e-money issuer and designation of payment instrument. If a planned product holds customers' money, moves it between parties or issues stored value, those are the terms to discuss with your adviser.
Applying to the Central Bank and renewing
Section 13 of the Act requires a person proposing to act as a payment service provider to apply to the Central Bank for authorisation before starting business. An authorisation is valid for twelve months. In deciding, the Bank considers the applicant's financial condition and history, its management, its capital adequacy and the public interest.
Section 14 adds two timing rules. An application to renew must be lodged at least two months before the authorisation expires, and a provider that does not start business within six months of authorisation must apply afresh.
Three practical points follow:
- Before, not after. The application comes before the business starts. A product launched first and regularised later is already in breach.
- A yearly cycle. Authorisation is not permanent. Diary the renewal well ahead of the two-month mark.
- Readiness. Financial history, management and capital are assessed, so prepare accounts, governance and capital plans before applying.
Mobile money operators as authorised providers
The Central Bank says mobile money transfer operators are authorised as payment service providers under the National Payment System Act 2011 and the National Payment System Regulations 2014.
For an ordinary business, that is the reassuring side of the picture. A shop that collects payment for its own goods through a paybill or till is using an authorised provider's service; applying for an M-PESA paybill covers that step. The question of authorisation becomes live when the business starts providing payment services to others: holding their funds, moving money between them, or presenting itself as a way to pay.
Three questions help you see which side of that line your model is on. Does money belonging to someone else pass through the business's accounts before reaching them? Does the business hold balances for users that they can spend or withdraw later? Does it tell people they can pay, or be paid, through it? A "yes" to any of them is the moment to take advice, before the product goes live.
Checking CBK's directory
The Central Bank publishes a directory of authorised payment service providers.
Use it in two directions. Before you partner with an aggregator, wallet or payment platform to collect your own money, check that the provider is listed. And if your own product is heading towards payment services, the directory shows how existing providers are categorised, which is a useful starting point for the conversation with your adviser.
False claims of designation
Section 29 of the Act makes it an offence to advertise or invite participation in a payment system or payment instrument while falsely claiming to be designated or recognised under the Act, with a fine of up to five hundred thousand shillings or one year's imprisonment. The Central Bank may also direct that misleading advertisements be withdrawn or amended.
That reaches marketing copy as much as product design. A website or app that describes itself as "CBK approved", "licensed" or "regulated" when it is not invites exactly that offence. Check every claim about regulatory status against the facts before it is published.
Achekam uses your own gateway accounts and is not merchant of record
When a business takes payments through Achekam, it does so through its own payment gateway accounts. A workspace administrator enters the business's own gateway credentials in Settings, under Payment Gateways & Checkout, and can test the connection with a real call to the gateway.
An invoice can carry a pay link through which the customer pays by a gateway the business has configured with its own keys, such as Paystack, Flutterwave, M-Pesa or Pesapal, or by EFT. A payment is recorded only from the gateway's verified notification, a status query or a person's capture, and without a configured gateway there is no pay link. Achekam is not the merchant of record: the business's agreement is with its own provider, and the money moves through the business's own account.
Taking M-Pesa live through the business's own short code is described in taking M-Pesa live, and bank-based options for larger payments in RTGS, cheques and other ways to pay.
The Central Bank's national payments system page explains how CBK defines and oversees the payment system, including payment service providers and mobile money, and links to its directory of authorised providers.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
