Skip to content
paybillke
Lending

Loan app harassment in Kenya: what to do (2026)

Step-by-step escalation for CBK Code of Conduct breaches by loan apps.

AO
by Reviewed by Michael Mwangi 10 min read Updated 26 August 2026Verified 26 Aug 2026

What counts as harassment under Kenyan rules

The CBK Digital Credit Providers Code of Conduct, issued alongside the 2022 Regulations and extended under the Business Laws (Amendment) Act No. 20 of 2024, prohibits specific practices:

  • Debt-shaming. Publishing or threatening to publish the borrower's default publicly.
  • Third-party outreach. Calling or messaging people in the borrower's phone contacts about the debt.
  • Threats of violence.
  • Misrepresenting the debt as owed to a court when there is no court order.
  • Out-of-hours calls. Calls or messages outside normal business hours.
  • False CRB listing. Listing amounts, dates, or entities that misrepresent the debt.

Step 1: preserve evidence

  1. Screenshot every text message, WhatsApp, or in-app message from the lender.
  2. Note call times and phone numbers. Voice-record if legally possible.
  3. Ask the contacted third party to send you the exact message they received.
  4. Keep the app install and permissions history if you can.

Step 2: written complaint to the lender

Send a written complaint to the lender (in-app support, email, or website form). Include:

  • Reference to the specific Code of Conduct provision(s) breached.
  • Evidence attached.
  • Demand for a specific remedy: stop the outreach, remove any false CRB listing, formal apology.
  • 15 working day deadline for resolution before escalation.

Step 3: escalate to CBK Consumer Protection

If unresolved after 15 working days (or immediately if the harassment is severe), escalate to CBK Consumer Protection:

  • Toll-free: 0800 720 000.
  • Reference the lender by registered company name and the specific Code of Conduct provision.
  • Attach evidence.

Step 4: escalate to the ODPC

For contact-scraping or third-party outreach, file a complaint with the Office of the Data Protection Commissioner at odpc.go.ke. This is separate from the CBK route; both can proceed in parallel.

Step 5: if the lender is unlicensed

Check the CBK register via our CBK licence checker. If the lender is not on the register:

  • Operating unlicensed is a criminal offence under Business Laws (Amendment) Act No. 20 of 2024, section 33S.
  • Report to the Directorate of Criminal Investigations if the harassment includes threats.
  • File with the ODPC for data-protection breaches.
  • Consider civil claim for harassment; see what to do if an unlicensed lender takes your money.

What not to do

  • Do not ignore in the hope it stops. Document from day one.
  • Do not threaten the lender back. Keep your correspondence formal.
  • Do not take a new loan to pay the harassing lender. Address the harassment first.

Sources

  1. Central Bank of Kenya. Digital Credit Providers Code of Conduct, 2022.
  2. Business Laws (Amendment) Act No. 20 of 2024, Republic of Kenya. Section 33S.
  3. Kenya Data Protection Act, 2019.
  4. Office of the Data Protection Commissioner. Complaint channel odpc.go.ke.
  5. Central Bank of Kenya. Consumer Protection line 0800 720 000.

FAQ

Is it illegal for a loan app to call my contacts?

Yes for a CBK-licensed lender: the CBK Digital Credit Providers Code of Conduct prohibits calling third parties in the borrower's phone contacts. For unlicensed lenders, the practice is also a Data Protection Act 2019 breach and can be reported to the ODPC.

Can a loan app threaten me with arrest?

No. Non-payment of a private commercial debt is a civil matter in Kenya, not a criminal one. Any lender threatening arrest for non-repayment is misrepresenting the law, which is itself a Code of Conduct breach.

What time can a loan app call me?

The CBK Code of Conduct restricts calls to reasonable business hours. Out-of-hours calls (early morning, late evening) are prohibited.

Further reading

Curated external sources we cite. Open in a new tab.