How to Verify a Fintech App Is Licensed in Kenya (CBK, CMA and ODPC Checks)
To verify a fintech app is licensed in Kenya, first work out what the app does. Then check the regulator that covers that activity. No single list covers every app.
A loan app, an investment app and a payments app answer to different regulators. Many fintechs need more than one licence.
This guide shows which regulator to check, where to look, and what to do if an app isn’t on the list.
Quick answer: who regulates what
| If the app… | Regulator | Where to check |
|---|---|---|
| Lends you money | CBK | CBK directory of digital credit providers |
| Moves money (wallets, remittance, payments) | CBK | CBK’s published lists of licensed providers |
| Invests your money (MMFs, shares, unit trusts, forex) | CMA | licensees.cma.or.ke |
| Collects your personal data | ODPC | ODPC register of data controllers and processors |
| Takes savings as a SACCO | SASRA | See our SACCO check guide |
Step 1: Find Out What the App Actually Does
Read the app’s description and terms of use. Note what it does with your money.
Does it lend to you? Hold your balance? Invest on your behalf? Each answer points to a different regulator.
Also find the registered company name in the terms. Many apps trade under a brand name that differs from the licensed company.
Step 2: Check the CBK
Loan apps. The CBK licenses non-deposit-taking digital credit providers, the companies behind most mobile loan apps. A lender missing from the CBK directory is not licensed as a digital credit provider, and the directory can list a company under a different name than the brand, for example Tala under Inventure Mobile Limited.
The list keeps growing. By July 2026 the CBK had licensed 252 digital lenders. Always check the latest version.
Banks and microfinance banks are licensed separately and don’t appear in the loan-app list.
Payment and remittance apps. Check the CBK’s published lists of licensed payment providers. Operating in Kenya is not the same as being licensed. In 2022 the CBK ordered banks to stop dealing with Chipper Cash and Flutterwave, saying they operated without a licence.
For a deeper loan-app check, read our guide on how to check if a digital loan app is CBK licensed.
Step 3: Check the CMA for Investment Apps
If an app invests your money, it should appear on the Capital Markets Authority’s list. The CMA runs an online portal at licensees.cma.or.ke covering fund managers, stockbrokers, investment banks, investment advisers, forex brokers and other intermediaries.
Why this matters: the CMA warned in July 2026 that fraudsters impersonate licensed firms using social media, apps and fake websites.
Check two things, not one:
- Is the company licensed? Look it up by name.
- Is the specific fund approved? A licensed fund manager does not automatically mean every product is approved. The CMA licenses intermediaries, while collective investment schemes are described as approved or registered.
Using the word “fund” or “wealth” in a name proves nothing. See our guides to money market funds for products you can verify.
Step 4: Check the ODPC for Data Protection
Any app that collects your ID, phone contacts or location handles personal data. That makes it subject to the Office of the Data Protection Commissioner.
Under the Data Protection Act, 2019, a person may not act as a data controller or processor unless registered with the Data Commissioner, subject to the registration thresholds. Registration certificates are generally valid for 24 months.
The ODPC publishes a register. It has published a list of registered data controllers and processors on its website.
Remember: ODPC registration is about data protection, not financial licensing. A registered app is not automatically a licensed lender or investment firm.
Step 5: Check the Company Behind the App
- Does the app name match the company in the regulator’s list?
- Does the company have a physical address and working contacts?
- Is the licence number shown, and does it match the register?
- Does the official website link to the same app in the store?
Being on Google Play or the App Store does not mean an app is licensed. Company registration doesn’t either. Incorporation with the Registrar of Companies does not mean a financial regulator has authorised the investment product.
Red Flags That Should Stop You
- Claims “CBK approved” or “CMA approved” but gives no licence number
- Promises guaranteed returns or “risk-free” profits
- Asks you to pay a fee to receive a loan or bonus
- Operates mainly through WhatsApp or Telegram groups
- Uses a regulator’s logo with no verifiable proof
- Pressures you to deposit quickly
What a Licence Does and Doesn’t Mean
A licence means a regulator supervises the firm. It does not guarantee your money is safe or that you will make a profit. Investments can still lose value.
Use licensing as a first filter, not as the only check.
What to Do If the App Isn’t Licensed
- Do not deposit money or upload your ID.
- Report unregulated lenders to the CBK. The CBK has urged the public to report unregulated digital lenders through its email address. Use the contact details on the CBK website.
- Report suspect investment schemes to the CMA. The CMA works with the Capital Markets Fraud Investigations Unit, a police unit based at its offices.
- Complain to the ODPC if an app misuses your data. The ODPC receives complaints from data subjects and investigates violations of the Data Protection Act.
- Report the app to the app store and to the police.
Frequently Asked Questions
How do I verify a fintech app is licensed in Kenya?
Identify what the app does, then check the matching regulator: CBK for lending and payments, CMA for investments, and ODPC registration for data handling.
Is every app on Google Play licensed?
No. App stores do not check financial licences.
Can a licensed app use a different brand name?
Yes. Check the company name in the terms of use against the regulator’s list.
Does a CMA licence guarantee my money?
No. It means the firm is supervised. Investments can still lose value.
Are crypto apps licensed in Kenya?
Rules for crypto platforms have been changing. Check current CBK and CMA notices before using one.
Where can I report a fake fintech app?
Report to the relevant regulator, the app store and the police. See the list above.
Regulator lists change often. Always confirm on the official CBK, CMA and ODPC websites before you use or invest in an app. This article is for information only and is not financial advice.
