Kenya’s banking and mobile money industry has operated for years on a simple premise. The institution that holds your money also controls your financial data. Banks know your transaction history. Mobile Money platforms like M-PESA know who you pay and how often. That data stays inside those institutions, and competitors cannot touch it, but the Central Bank of Kenya wants to change that.
The National Payment System Bill 2026 draft would require banks and payment providers to build systems that securely share customer data with licensed third parties for open finance purposes. Once a customer gives consent, the Central Bank of Kenya can require providers to enable that sharing. The bill also mandates interoperability, compelling all payment service providers to use systems compatible with competitors.
The proposal could loosen the grip that banks and mobile money providers hold over customer relationships. That would allow licensed fintechs to compete for customers without owning the accounts where their money sits. In a market where M-PESA controls 89.1 percent of mobile money subscriptions, that is a significant shift.
The Bill Creates Two New Categories of Financial Players
The licensing schedule introduces two new types of licensed entities. Payment initiation service providers can execute payments on a customer’s behalf. Account information service providers can pull data across accounts and give customers a single view of their finances.
Neither category needs to hold customer funds. The bill requires electronic money issuers and wallet providers to keep customer money in trust accounts at a bank. The new service providers operate on top of existing accounts, which lowers barriers to entry and opens the market to companies that want to build products without becoming banks.
The bill does not specify what data third parties can access, under what conditions, or at what cost. It leaves those details to subsequent CBK regulations. The licensing structure establishes the framework. The operational rules come later.
M-PESA’s Data Monopoly Faces Its Biggest Challenge
M-PESA processes roughly 46.41 billion transactions valued at Sh41.68 trillion annually. That transaction history gives Safaricom’s mobile money platform an enormous advantage in credit scoring, customer profiling and product development. The World Bank has noted that data mobility is not in place, leaving M-PESA with a significant advantage built on years of user data.
The bill would require M-PESA and other mobile money providers to share that data with licensed third parties once customers consent. That means a fintech could access a customer’s M-PESA history to offer a loan, build a savings product or provide financial advice without the customer leaving the platform.
The Kenya Bankers Association and Safaricom have previously resisted interoperability efforts, citing implementation costs . The bill addresses that resistance by making data sharing a legal requirement rather than a voluntary arrangement. Providers have one year to comply from the date the law takes effect .
Kenya Joins Nigeria and South Africa in
Kenya is not moving alone. The Central Bank of Nigeria became the first regulator in Africa to issue a formal open banking framework in 2021 and has been rolling out implementation guidelines through 2026. The South African Reserve Bank has published working papers making the case for open banking as a tool for financial inclusion and is drafting legislation to revamp the national payments ecosystem.
Each country is approaching the problem differently. Nigeria uses a centralised open banking registry run by the Nigeria Inter-Bank Settlement System with consent-based access anchored on the Bank Verification Number. South Africa is testing a market-driven approach, though the Reserve Bank has noted that this model limits its reach.
Kenya’s proposed bill differs because it covers mobile money providers alongside traditional banks. That matters in a market where mobile money, not banking, is the primary financial tool for most adults. Over 84 percent of Kenyan adults hold formal financial accounts, and most of those accounts are mobile money wallets rather than bank accounts.
The bill would also require all payment service providers to use interoperable systems, extending a push that began with mobile money interoperability in 2018. That earlier effort allowed customers to send money across networks. This bill extends the principle to data.
Consumer Benefits Depend on Consent Design
Open finance promises tangible benefits for consumers. They gain greater transparency, control and choice over financial services. They can authorise data sharing to access better loan terms, personalised products and seamless experiences across platforms.
The economics work through reduced information asymmetry. When lenders can see a borrower’s full transaction history, they can price risk more accurately. That leads to lower interest rates for good borrowers and fewer rejections for people with thin credit files. FSD Kenya has noted that open finance can reduce customer onboarding costs, improve risk assessment and make new customers visible to lenders who previously could not assess them.
Consent is the mechanism that makes this work. The bill requires the CBK to enable data sharing only after a customer gives consent. Kenya’s Data Protection Act, 2019 already governs how personal data moves between entities. The Office of the Data Protection Commissioner enforces the Act and handles complaints from individuals whose data rights are violated.
The gap is operational. FSD Kenya has identified a need for detailed guidance on consent and data protection in open finance . The Data Protection Act provides the legal foundation. The CBK regulations will determine how consent works in practice. Questions remain about how customers revoke consent, how long third parties can retain data and who bears liability when something goes wrong.
The Risks of Open Data Are Real but Manageable
Data sharing creates new risks. The more entities that can access financial data, the wider the attack surface for fraud and unauthorised access. Liability becomes complicated when multiple parties touch the same data. A customer who suffers harm from a data breach needs to know who to hold accountable.
The bill’s requirement that providers build systems capable of secure data sharing addresses part of the risk. The Data Protection Act addresses another part. The remaining risk sits in the details that the CBK will write into regulations.
Kenya has experience managing these trade-offs. The country’s mobile money system already handles billions of transactions annually with relatively low fraud rates. The interoperability that allows cross-network transfers required similar coordination between competitors. The data-sharing framework extends that coordination to a new domain.
Parliament Will Decide Whether This Becomes Law
The National Treasury and the CBK have invited public participation on the draft bill. Submissions go to CBK Governor Kamau Thugge by October 9. The bill then moves to Parliament, which will debate its provisions and decide whether to pass it into law.
If Parliament passes the bill, banks and mobile money providers have one year to comply. The CBK then writes the regulations that determine how data access works in practice. Those regulations will shape whether open finance delivers on its promise of more competition and better consumer outcomes.
Kenya’s digital financial sector consistently ranks among the top three African markets for fintech startups. The country has the infrastructure, the mobile money adoption and the regulatory capacity to make open finance work. What it lacked was a legal framework that required data sharing rather than merely encouraging it. This bill provides that framework.
The open finance model works only if incumbents open their data and new entrants can afford to plug in. The bill opens the pipes. Whether the water flows depends on what the CBK writes into the regulations and how the market responds.