Kenya is pushing toward open banking β and M-PESA's data dominance may never look the same again.
The Central Bank of Kenya has published a draft National Payment System Bill, 2026, which would give it the authority to require banks and payment providers to share customer data with licensed third parties. It is one of the boldest regulatory moves in East Africa's digital finance space in years.
What the Bill Actually Proposes
Under the draft legislation, every payment service provider and payment system operator would be required to build systems capable of securely sharing customer data for what the bill calls "open finance purposes." The Central Bank of Kenya (CBK) would then have the power to direct providers to enable that sharing β but only after customers have given their consent.
"Each payment service provider or payment system operator shall use systems that are capable of securely sharing customer data with third parties for open finance purposes," the draft bill reads.
The bill does not name specific third parties, but it creates two new licensing categories. Payment initiation service providers would be allowed to execute payments on a customer's behalf, while account information service providers could pull data and present customers with a consolidated view across multiple accounts.
Crucially, neither category would need to hold customer funds β a significant departure from how electronic money issuers and wallet providers currently operate. Those existing players would still be required to keep customer money in trust accounts held at a bank.
Data Locked in Banks and M-PESA Becomes a Battleground
The implications for Kenya's financial ecosystem are substantial. Right now, banks and M-PESA β Safaricom's dominant mobile money platform β hold enormous amounts of customer transaction data, and that control shapes their competitive advantage. If the CBK's proposal passes, licensed fintechs would gain a path to access that data, letting them build competing products without needing to own the underlying accounts.
That is the core tension the bill introduces: it could fundamentally shift who has power over the data-driven financial services that millions of Kenyans use daily.
The bill also takes a fresh swing at interoperability, compelling all financial and payment service providers to use systems that are compatible with those of their competitors.
Key Details Still Left to CBK Regulation
The draft is notably vague on implementation mechanics. It states the CBK "may require" providers to enable data sharing and "shall make regulations to give effect to this section" β meaning the specifics around what data can be accessed, under what conditions, and at what cost would be determined through later CBK regulations rather than the bill itself.
The one-year compliance window is spelled out directly in the bill: "Upon the commencement of this Act, any person providing payment services shall, within one year of the commencement, comply with the provisions of this Act."
What This Means for Kenya's Fintech Sector
Kenya is already one of Africa's most mature digital payments markets, so the stakes here are high. The bill's passage through parliament would mark a formal embrace of open banking principles β a shift that is been reshaping fintech competition in Europe and parts of Asia for years but has moved slowly across the continent.
For Kenyan fintechs, the proposal represents a rare legislative opening. For incumbent banks and Safaricom, it signals that the era of sitting on proprietary customer data without regulatory challenge may be coming to an end.
The draft bill is still at the proposal stage and would need to pass Kenya's parliament before it carries the force of law.