Your rights under CBK Code of Conduct Kenya 2026

Your rights under the CBK Code of Conduct for digital and asset lenders (2026)

The Code prohibits debt-shaming, contacting people in your phone contacts, threatening violence, misrepresenting a debt as owed to a court, false CRB listing, and out-of-hours calls. What to do when a licensed lender violates each, and the escalation ladder.

by Arnold Ochieng Reviewed by Michael Mwangi 10 min read Updated 26 August 2026Verified 26 Aug 2026

The Code of Conduct is where the practical borrower protections live. It is short, it is specific, and it is the document to cite when a lender crosses a line. This page walks through the prohibitions that matter most, what to do when each is breached, and the escalation ladder that turns a complaint into an outcome.

Who the Code applies to

The Code was originally issued alongside the 2022 Digital Credit Providers Regulations, targeting the digital lending category. Under the Business Laws (Amendment) Act No. 20 of 2024, in force 27 December 2024 [Source 1], the credit provider category was renamed "non-deposit taking credit business" and expanded to expressly include asset financing, PAYGo, and BNPL. The Code's conduct rules now apply across that wider category [Source 2].

In practical terms, this means the Code covers Watu, Mogo, M-KOPA, Tala, Zenka, and every other CBK-licensed non-deposit credit provider (see the CBK register on our CBK Licence Checker). It does not cover entities that are not on the register.

The prohibitions that matter

Debt-shaming

The Code prohibits publishing or disclosing a borrower's debt to third parties as a collection tactic. That includes social media posts, WhatsApp groups, and any form of public shaming. If a licensed lender does this, document the disclosure (screenshots, links, dates) and escalate.

Contacting people in your phone contacts

Calling, SMSing, or WhatsApping people in the borrower's phone contacts (family, employers, colleagues, church group) to disclose the debt or apply pressure is prohibited. This is one of the most common Code breaches historically in the Kenyan digital lending category.

If it happens, ask the third party to record the date and time of the contact, the caller ID or number, and the exact wording used. That is your evidence.

Threats of violence, false threats of arrest

Threats of physical violence are prohibited outright. Threats of arrest, or claims that police or court action is imminent when it is not, are also prohibited under the misrepresentation clause below.

Misrepresenting a debt as owed to a court

Claiming that a debt has been converted to a court judgment when no such judgment exists is prohibited. Fake "court orders" sent by WhatsApp, fake "warrant of arrest" documents, and threats of imminent bailiff action without a genuine court process are all Code breaches.

False CRB listing

Reporting a debt to a Credit Reference Bureau when the debt is not properly documented, is disputed, or is under the KES 1,000 floor set by the CBK Credit Reference Bureau Regulations 2020, is prohibited [Source 3]. See how to get off CRB in Kenya for the clearance and dispute process.

Harassing calls outside business hours

Repeated calls outside normal business hours, or in a pattern that constitutes harassment, are prohibited. Document call logs.

The escalation ladder

To the lender first, in writing. Email is fine, WhatsApp is not (WhatsApp is easy to lose or dispute). Set out the incident, the Code provision breached, and the outcome you are seeking. Give a reasonable deadline (14 days is standard).
To CBK Consumer Protection at 0800 720 000. If the lender has not responded to your written complaint within the deadline, or has responded inadequately, escalate to CBK. Reference the Code provision and attach your written complaint and any evidence [Source 2].
To court. If CBK does not resolve the matter, the final route is civil court. Small Claims Court for small-value disputes, High Court for larger. Legal advice is worth its cost.

Where the lender is unlicensed, the ladder is different. See what to do if an unlicensed lender takes your money.

Standing to complain

The primary complainant is the borrower. But third parties whose contacts were misused (a family member called by a lender they have no relationship with, an employer emailed about an employee's debt) also have standing to complain to CBK.

Documentation to keep

The single most important predictor of whether a complaint succeeds is the quality of the paper trail:

Call logs from your phone showing lender contact frequency and timing.
Screenshots of SMS and WhatsApp messages, including sender number and timestamp.
Copies of any documents purporting to be from a court or the police.
Statements from third parties confirming they were contacted (name, date, wording).
Your loan agreement, statement, and any repayment receipts.
The lender's CBK licence number and date (from the register), so you and CBK can identify the licensed entity precisely.

Time limits

Complaints should be raised promptly. There is no single statutory deadline, but the further you get from the incident, the harder the paper trail is to reconstruct and the weaker the evidentiary case. Where a pattern of behaviour is ongoing, complain now rather than accumulating months of incidents before raising.

Realistic outcomes

A well-documented Code complaint against a CBK-licensed lender can result in the lender being required to cease the specific practice, formal sanctions, or in serious cases licence revocation. It rarely results in immediate financial compensation to the individual borrower; the Code is a conduct framework, not a compensation scheme.

For the wider framing of what a CBK licence does and does not do, see why CBK licensing matters if you are borrowing. For default and repossession specifics on Watu, Mogo, and Lipa Mdogo Mdogo, see what happens if you default on Watu Credit and what happens if you miss a Lipa Mdogo Mdogo payment.

Sources appendix

Business Laws (Amendment) Act No. 20 of 2024, Republic of Kenya. In force 27 December 2024. Extends the credit-provider category to cover asset financing, PAYGo, and BNPL. Section 33S penalties for unlicensed operation.
Central Bank of Kenya. Digital Credit Providers Code of Conduct, issued alongside the 2022 regulations, extended to non-deposit credit providers under the 2024 amendments. Basis for the prohibitions on debt-shaming, third-party contact, threats, misrepresentation, false CRB listing, and out-of-hours harassment. CBK Consumer Protection line 0800 720 000.
Central Bank of Kenya. Credit Reference Bureau Regulations, 2020. Basis for the KES 1,000 floor below which CRB listing is prohibited.

FAQ

What is the CBK Code of Conduct?

A set of conduct rules issued by the Central Bank of Kenya alongside the 2022 Digital Credit Providers Regulations, extended in scope to non-deposit-taking credit providers (including asset financiers and PAYGo providers) under the 2024 amendments.

Can a CBK-licensed lender call the people in my phone contacts?

No. Contacting third parties in the borrower's contacts to disclose or pressure on the debt is prohibited by the Code.

What if the lender threatens me?

Threats of violence, threats of arrest without a court order, and misrepresenting a debt as owed to a court are all prohibited. Document each incident and file a complaint via the escalation ladder below.

Where do I complain?

To the lender first, in writing. If unresolved, CBK Consumer Protection at 0800 720 000. If still unresolved, court.