New CBK Rules: Banks, M-Pesa could get greenlight to share users' financial data

For millions of Kenyans who move money through a bank account or mobile phone, the proposal could change something most people rarely think about:

Who gets to access the financial trail they leave behind?

The Central Bank of Kenya (CBK) and National Treasury have published the draft National Payment System Bill, 2026, alongside a draft National Payment System Policy, opening the proposals to public participation.

The Bill seeks to replace the existing National Payment System Act and modernise the legal framework around payments, fintech, consumer protection and data.

So, what exactly is changing?

The proposed law introduces an open-finance framework.

Under the system, banks, mobile-money platforms and other payment service providers would be required to have systems capable of securely sharing customer data with third parties for open-finance purposes.

Importantly, the draft Bill says CBK may require a payment service provider or payment-system operator to establish a mechanism for securely sharing customer data after obtaining the customer’s consent.

That means the proposal is not simply saying that M-Pesa or your bank can freely sell or hand over your transaction history to any company.

The idea is to create a regulated route through which a customer can authorise another licensed financial service to access information held by their existing provider.

What could they see?

The exact categories and technical standards would depend on regulations made under the proposed law.

The information held by a financial provider could become portable between regulated services where the customer authorises access.

That could include information connected to accounts, payments and transaction activity - the financial information a provider needs to make another service work.

For example, instead of giving a fintech screenshots or manually downloading bank statements when applying for a service, a customer could potentially authorise the fintech to retrieve the relevant information directly through a regulated connection.

The proposed framework also contemplates account-information and payment-initiation services, bringing Kenya closer to the open-banking systems already used in several other markets.

Why does CBK want this?

The argument is largely about competition and innovation.

At present, financial data is concentrated inside the platforms where transactions take place.

A bank knows what happens in a customer's account; a mobile-money provider has visibility of activity on its platform.

Open finance could allow licensed fintechs to build services around information that customers already generate, without each new company having to build a completely separate relationship with every bank or payment provider.

That could make it easier to develop products for payments, personal financial management, credit and other financial services.

CBK says the wider Bill is intended to promote interoperability, competition, innovation and financial inclusion while strengthening consumer and data protection.

What about M-Pesa?

M-Pesa is already regulated within Kenya's National Payment System framework because mobile-money operators operate as authorised payment service providers.

CBK says payment service providers include entities involved in sending, receiving, storing or processing payments through electronic systems.

Under the proposed framework, therefore, mobile-money platforms would fall within the broader ecosystem whose systems may have to support secure data sharing.

But that does not mean another company automatically gets access to a person's M-Pesa history.

The proposed mechanism specifically refers to customer consent, while the provider would have to use systems capable of securely sharing the information.

The Data Protection Act

Kenya's Data Protection Act gives individuals rights over their personal information, including the right to know how their data is being used, access personal data held about them, object to certain processing and seek correction of inaccurate information.

The Office of the Data Protection Commissioner also requires personal data to be processed lawfully, fairly and transparently and limited to what is necessary for the stated purpose.

That becomes particularly important when financial data is involved because transaction records can reveal much more than simply how much money someone has.

They can reveal spending patterns, businesses a person deals with, regular payments and other aspects of their financial life.

What happens if the Bill becomes law?

The proposal still has to go through Kenya's legislative process.

If enacted, payment providers would then have to comply with the new requirements.