Unlicensed Loan Apps in Kenya: List of Red Flags & How to Protect Yourself

“`

Getting a loan through your phone can take only a few minutes. That convenience is useful when you have a genuine short-term need, but it also makes it easier to accept a loan before checking who is behind the app.

In Kenya, digital credit providers are regulated. The Central Bank of Kenya (CBK) has the power to license and supervise digital credit providers, while licensed lenders are subject to rules covering credit collection, customer information, loan terms and complaints handling.

That does not mean every unfamiliar loan app is automatically a scam. A lender may be legitimate even if you have never heard of it. The important question is whether the business is legally authorized to provide the type of credit it offers and whether it follows the rules that apply to digital lending.

This guide explains how to spot unlicensed loan apps in Kenya, what the law says about harassment and contact-list abuse, and what you can do if a lender misuses your personal information.

What Is an Unlicensed Loan App?

An unlicensed loan app is a digital lending service that operates without the authorization required for the credit business it is conducting in Kenya. Under the Central Bank of Kenya Act, a person cannot carry on digital credit business unless licensed by the CBK or permitted to do so under another written law.

The Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 also require licensed digital credit providers to follow rules around pricing, credit assessment, customer information, debt collection and complaints.

This distinction matters because an app can look professional without being properly regulated. A polished Android application, a website, a WhatsApp number and hundreds of positive-looking reviews do not prove that a lender is licensed.

9 Red Flags of Unlicensed Loan Apps in Kenya

No single warning sign proves that a lender is unlicensed. Instead, use these signs as reasons to stop and verify the company before borrowing.

1. You Cannot Verify the Lender With CBK

This is the most important check.

CBK publishes information about licensed digital credit providers. For example, its published directory has included the provider’s legal name, trading name, physical address, contact information and licensing date.

Do not search only for the app’s brand name. A company may operate an app under a different trading name. Compare the legal entity behind the app with the information published by CBK.

Check the CBK website →

2. The App Hides Who Actually Owns It

A serious lender should not make you guess who you are dealing with.

Be cautious when an app gives you only a first name, a Gmail address, a Telegram username or a mobile number but provides no clear company identity, physical address or customer support channel.

That does not automatically prove illegality. It does, however, make verification much harder—and that is a good reason not to hand over your ID, phone number and financial information yet.

3. The App Wants Access to Your Contacts for Debt Collection

This is one of the strongest warning signs.

Under Regulation 20 of the Digital Credit Providers Regulations, a digital credit provider must not access a customer’s phonebook or contacts for the purpose of sending messages after untimely payment or non-payment. The regulations also prohibit unauthorized or unsolicited calls or messages to a customer’s contacts and debt-collection tactics intended to harass, oppress or abuse people.

4. The Loan Terms Are Vague or Hidden

Before giving you credit, a digital credit provider should provide the terms and conditions of the loan agreement.

The regulations require important information such as the loan amount, charges, interest rate, other applicable fees, due date, total cost of credit and annual percentage rate.

Be careful if an app shows you a large “approved amount” but does not clearly explain how much will actually reach your M-Pesa account, how much you will repay, and when the full amount is due.

5. The App Uses Pressure Instead of Clear Information

“Pay now or we will expose you” is not normal consumer communication.

A legitimate debt can still be collected. A borrower can still be charged according to a valid loan agreement. But debt collection has limits.

Kenya’s digital credit regulations specifically prohibit threats, violence, obscene or profane language used for shaming, publication of personal information to shame borrowers, unauthorized contact with other people, and other abusive collection practices.

6. It Promises a Loan Before Checking Whether You Can Repay

Another warning sign is an app that appears to approve everyone without asking meaningful questions about the borrower’s ability to repay.

Under Regulation 18, a digital credit provider must take reasonable steps to assess a customer’s ability to repay before advancing credit.

This does not mean every lender will ask you for payslips or bank statements. Digital lenders can use different credit-assessment methods. The point is that responsible lending involves some assessment rather than simply pushing money out with no consideration of repayment capacity.

7. You Are Asked for Money Without Understanding Why

Requests for registration fees, processing fees or other payments deserve scrutiny—especially when the lender refuses to explain the charge or provide proper terms.

Do not assume that every upfront payment automatically means a lender is illegal. Instead, ask what the payment is for, whether it appears in the loan agreement, who receives it and whether you can verify the company independently.

Most importantly, never send money simply because someone says you must “unlock” an approved loan.

8. The App Threatens to Publish Your Information

A debt does not give a lender a free pass to publish your private information online.

The Digital Credit Providers Regulations prohibit posting a customer’s personal or sensitive information online or on another forum for the purpose of shaming them.

If someone threatens to publish your ID, photograph, contacts or other personal information, save the evidence rather than deleting the messages.

9. The App Has No Proper Complaints Process

A licensed digital credit provider is required to establish a complaints redress mechanism and communicate that mechanism to customers. Complaints should be resolved promptly and, where immediate resolution is not possible, within 30 days.

If the only way to reach a lender is through an anonymous WhatsApp number that stops responding when you raise a complaint, treat that as another reason to step back and investigate.

Licensed vs. Suspicious Loan Apps: What to Look For

Can a Loan App Legally Contact Your Friends and Family?

There is an important difference between using information supplied as part of a legitimate credit process and using somebody’s contact list to embarrass or pressure them into paying.

The Digital Credit Providers Regulations specifically prohibit a digital credit provider from accessing a customer’s phonebook or contacts for the purpose of sending messages because of late or missed payment. They also prohibit unauthorized or unsolicited calls or messages to the customer’s contacts.

The Data Protection Act, 2019 provides additional rules governing the processing and disclosure of personal information.

Section 72 deals specifically with unlawful disclosure of personal data. The general penalty under Section 73 can be a fine of up to KES 3 million, imprisonment for up to 10 years, or both, where no specific penalty applies. The exact legal consequence depends on the offence and circumstances.

What to Do If a Loan App Is Harassing You

If you are already dealing with threatening calls, messages to your contacts or misuse of your personal information, do not panic. Start by preserving evidence.

1. Document Everything Before Deleting the App

It is tempting to delete an abusive app immediately. First preserve the evidence you may need later.

Take screenshots showing dates, phone numbers, messages and threats. If your contacts received messages, ask them to preserve screenshots too. Keep copies somewhere outside the phone if possible.

2. Check Your App Permissions

On your phone, review the permissions granted to the application. Depending on your Android version, you can usually find this under the app’s information or permissions settings.

Removing a permission does not erase information that has already been collected. That is why evidence and reporting matter if you believe your personal information has already been misused.

3. File a Complaint With the ODPC

The Office of the Data Protection Commissioner (ODPC) provides an online process for data-protection complaints. The office says complainants can attach supporting documents to substantiate their claims.

File a complaint with ODPC →

4. Report the Lender to Loanely

If you believe a loan app is operating illegally or using abusive collection methods, you can also submit the details through our Report a Lender page.

When reporting a lender, provide as much verifiable information as possible. A lender’s name, app name, website, phone number and evidence of the conduct are more useful than simply saying that the company is “bad.”

Missing a Loan Payment Does Not Automatically Make the Lender Illegal

This distinction is important.

You can owe a legitimate debt and still have rights as a borrower. A lender can pursue repayment using lawful methods. At the same time, a borrower’s default does not give a digital lender permission to threaten, shame, abuse or expose the borrower.

The Digital Credit Providers Regulations also place a limit on what a digital credit provider can recover from a non-performing loan. Regulation 19 generally limits recovery to the principal outstanding when the loan became non-performing, contractual interest not exceeding that principal, and reasonable recovery expenses, subject to the regulation’s terms and exceptions.

So the right response to a missed payment is not to assume that either side is automatically right or wrong. Read the agreement, keep records and challenge conduct that appears to violate the rules.

How to Check If a Loan App Is Licensed by CBK

Use this process before borrowing:

1. Find the legal company name. Look beyond the app’s marketing name.
2. Visit the CBK website. Use the regulator’s published digital credit provider information rather than relying on screenshots supplied by the lender.
3. Compare the details. Check the legal name, trading name and other identifying information.
4. Check the loan agreement. Confirm the amount you receive, charges, interest, repayment date and total cost.
5. Check the data practices. Understand what personal information the app wants and why.
6. Walk away if you cannot independently verify the lender.

CBK’s published directory is particularly useful because it identifies providers by company information rather than simply by the names consumers see in advertisements.

More Loan Safety Guides

Frequently Asked Questions About Unlicensed Loan Apps

How do I know if a loan app is licensed in Kenya?

Find the legal company behind the app and compare it with the digital credit provider information published by the Central Bank of Kenya. Do not rely only on the app’s logo, website or claims that it is “CBK approved.”

Can an illegal loan app access my contacts?

An app may technically request access to contacts, but that does not mean the lender is free to use the information for debt collection. Kenya’s Digital Credit Providers Regulations prohibit digital credit providers from accessing a customer’s phonebook or contacts for the purpose of messaging them because of late or missed payment.

Can a loan app shame me for not paying?

Digital credit providers are prohibited from using threats, obscene or profane language for shaming, publishing personal information to shame borrowers, unauthorized contact with other people, and other abusive debt-collection practices.

What should I do if a loan app contacts my friends?

Save screenshots and other evidence, record the lender’s details, review the app’s data permissions, and consider filing a complaint with the Office of the Data Protection Commissioner. You can also report the lender through Loanely’s Report a Lender page.

Is every short-term loan app a scam?

No. A short repayment period does not by itself prove that a lender is illegal. The better approach is to verify the lender’s authorization, read the loan terms, understand the total cost and check how the lender handles personal data and debt collection.

What is the penalty for unlawful disclosure of personal data in Kenya?

Section 72 of the Data Protection Act addresses offences involving unlawful disclosure of personal data. Where no specific penalty applies, Section 73 provides for a fine of up to KES 3 million, imprisonment for up to 10 years, or both. The applicable penalty depends on the specific offence and circumstances.

“`