Loan app in Kenya? Check these details before you borrow

Pause before you apply

A quick loan can solve an urgent problem, but the fastest application is not always the easiest debt to repay. Before you install an app, upload an ID or accept an offer, pause long enough to identify the provider, understand the full cost and decide whether the data it requests makes sense.

No single check proves that a loan will be affordable or that every interaction will go well. A familiar app name, a polished advert or a listing in an app store is not a substitute for checking the provider and reading the agreement. Use several independent checks together.

1. Identify the legal provider behind the app

Start with the app or website’s full legal name, not only its brand name. Look in its terms, privacy notice and contact page for the registered company name; physical and postal address; working support email or telephone number; the regulator it says supervises it; and the exact name that will appear in the loan agreement and payment instructions.

Write these details down before applying. A brand can differ from the company’s legal name, so compare both. If the names change between the advert, download page, terms and payment request, stop and ask the provider to explain the relationship in writing.

Do not treat a company-registration result as proof that a lender is authorised to provide digital credit. Registration and regulatory status answer different questions.

2. Check the current CBK directory

The Central Bank of Kenya publishes a directory of licensed digital credit providers and updates it as licensing changes. Use the directory linked from CBK’s own website, then compare the legal name and contact details with what the app gives you. At publication, the current directory was updated on 29 September 2026.

The Digital Credit Providers Regulations say a person must not carry on digital credit business in Kenya or present itself as doing so unless licensed by CBK, except where its digital credit business is regulated under another written law. This exception matters: a bank or another regulated institution may not appear in the same digital-credit-provider directory. If you cannot find a name, do not jump straight to an accusation. Ask which regulator and licence apply, and verify that answer on the regulator’s own website.

Search results, social posts and screenshots of old lists can go out of date. Open the current directory from CBK each time you check.

3. Read the cost in shillings, not just the headline rate

Before accepting, find the amount you will actually receive and the total amount you must repay. Record the principal advanced; interest; processing, service or account fees; taxes or third-party charges; late-payment charges; repayment date and instalment schedule; and the consequences of early or late repayment.

For a simple comparison, subtract the amount that reaches you from the total repayment. Then ask whether the repayment still fits your budget if income is delayed. A low-looking percentage can be hard to interpret without knowing the period it covers and which additional fees apply.

Do not accept an offer while the total repayment, due date or penalties are hidden behind a button you cannot review. Save your own copy of the terms and repayment schedule. Your copy helps you remember what you accepted and supports a complaint if the account does not match it.

4. Inspect permissions before sharing your data

A credit application may reasonably need identity, contact and financial information. That does not mean every phone permission is necessary. Before installing or continuing, read the privacy notice and the permission prompts. Ask what data is collected, why each item is needed, who it will be shared with, how long it will be kept, how inaccurate information can be corrected or deleted, and whether you can apply without giving access to unrelated contacts, photos, messages or files.

The Office of the Data Protection Commissioner says a data subject has rights to be informed how personal data will be used, to access it, to object to processing, and to seek correction or deletion of false or misleading data. Its published principles also say collection should be limited to what is necessary for the stated purpose.

Treat a request for your M-PESA PIN, mobile-banking password, one-time code or email password as a stop signal. Do not share authentication secrets. If you have already shared one, change it through the provider’s official channel and contact the relevant bank or mobile-money provider.

5. Verify payment instructions independently

Application, processing or “unlock” payments made before a loan is released deserve extra scrutiny. Do not send money to a personal number merely because a caller or chat account says it belongs to the lender.

Confirm any Paybill, Till, account name or repayment channel using the provider’s official app, website or published support contact. Compare the recipient name shown in the payment confirmation screen before entering your PIN. If the instructions arrive only through an unsolicited WhatsApp message, SMS or social-media inbox, contact the provider independently.

A caller who knows your name, ID number or application amount has not proved that they are authorised. Personal details can be copied or misused. End the call and return through a channel you verified yourself.

6. Check how complaints and debt collection should work

The Digital Credit Providers Regulations require a provider to have a dedicated complaints channel. A complaint should be resolved promptly or, where immediate resolution is not possible, within 30 days. The regulations also prohibit debt-collection conduct such as threats, violence, obscene language, shaming a customer by posting personal or sensitive information, unsolicited contact with a customer’s phone contacts, and other conduct that harasses, oppresses or abuses a person.

Before borrowing, find the complaints channel in the app or terms. If there is no clear way to raise a complaint, that is a reason to pause. If you later complain, keep the reference number, date, response and a private copy of the relevant agreement and transaction records.

Keep those records private. Do not publish your ID, account statements, contact list or loan agreement in a public post when asking for help.

7. Know where to take an unresolved problem

Start with the provider’s formal complaints channel and state the outcome you want, such as a corrected balance, explanation of a fee, updated record or end to inappropriate contact. Keep the wording factual and include only the evidence needed through the private complaint channel.

For suspected misuse of personal data, the ODPC provides an online complaint process for a data subject or an authorised representative. Its complaint page says supporting documents can be attached and submitted information will be treated confidentially. For a regulatory concern, use the regulator that actually supervises the provider, identified through an official directory or the institution’s verified disclosures.

If someone threatens you or you believe a crime may have occurred, use an official police reporting channel. For an immediate risk to your bank or mobile-money account, contact that provider first through a number or app you already trust.

A five-minute loan-app check

Before you accept, confirm all seven: 1. I know the provider’s legal name and verified contact details. 2. I checked its regulator using a current official source. 3. I know the amount I will receive and the total amount I must repay. 4. I understand the due date, fees, penalties and complaint route. 5. The requested phone permissions match a clear purpose. 6. I independently confirmed the disbursement and repayment channels. 7. I kept a private copy of the terms without sharing PINs or one-time codes.

If one answer is unclear, pause. Search the provider’s website, phone number, Paybill, Till or company name on ScamBusterKE to see whether the community has shared relevant reports. A search result is a lead for further checking, not proof about a person or business. If you report an experience, describe what happened and keep sensitive evidence private.