Login Kenya’s payments market looks deceptively easy from the outside. M-Pesa is pulling 39 million subscriptions, Flutterwave, DPO and Pesapal all advertise “one API for Africa,” and most founders assume that taking money from Kenyan customers is mostly an integration problem.
It isn’t. Since December 2024 — and especially since July 2025 — the legal stack around foreign payment acceptance in Kenya has tightened on three fronts at once. The Central Bank of Kenya (CBK) treats unauthorised cross-border payment services as a criminal offence. The Kenya Revenue Authority (KRA) has scrapped the threshold below which non-residents could ignore Kenyan tax. And the Virtual Assets Service Providers Act came into force on 4 November 2025, closing the last grey-zone path most crypto-adjacent businesses were using.
This is what a non-Kenyan company actually needs to do to take payments from a Kenyan customer without ending up on a KRA demand notice — or with its domain blocked by the Communications Authority of Kenya.
Collected by KRA from 454 registered foreign digital providers by August 2025, up from 178 earlier in the year. Kenyan tax on foreign digital revenue is now enforced, not theoretical.
Key takeaways
- ✓ Three regulators, not one. CBK cares about authorisation, KRA cares about tax, and Safaricom cares about M-Pesa. They do not coordinate with each other, so you have to.
- ✓ The tax threshold is gone. Since 1 July 2025 the KES 5 million de minimis for SEP tax has been scrapped. One dollar of revenue from a Kenyan user triggers both 3% SEP tax on gross and 16% VAT, each filed monthly via iTax by the 20th.
- ✓ The two-door choice is binary. Either partner with a CBK-licensed PSP and sit downstream of their licence, or apply for your own CBK authorisation with KES 5M–50M core capital and 6–12 months of regulator engagement.
- ✓ M-Pesa is not optional. Around 70% of Kenyan adults default to mobile money. Stripe alone does not support M-Pesa or KES settlement as of 2026, so the dual-gateway pattern — Stripe for cards, a local provider for M-Pesa — is the default for cross-border merchants.
- ✓ KRA has operational teeth. Beyond a 5–20% penalty plus 1% monthly interest, KRA can instruct the Communications Authority of Kenya to block your domain for Kenyan users.
- ✓ Aggregator vs direct Daraja flips around KES 30M per month. Below that, route M-Pesa through Flutterwave or Pesapal and pay the 30–80 bps premium. Above it, direct Daraja integration starts to pay back — but you need a Kenyan entity and a Kenyan bank account.
- ✓ Two compliance items most foreigners miss. Data Protection Act registration with the ODPC (KES 4K–40K a year, with extraterritorial reach) and the FATF grey-list scrutiny your PSP passes down as heavier KYB and source-of-funds questions.
- ✓ Crypto is in a holding pattern. The VASP Act has been in force since 4 November 2025, but no VASP has been licensed because Treasury has not issued the implementing regulations. If your model touches crypto on/off-ramps, stablecoins or custody, you cannot legally launch in Kenya right now.
- ✓ The PE trade-off. A Kenyan subsidiary takes you out of the SEP regime (3% on gross) and into standard corporate income tax (30% on net). Better for high-margin businesses, worse for low-margin ones — the maths flips around roughly 10% net margin.
The two doors
Every foreign business accepting payments in Kenya makes the same choice, even if it doesn’t realise it.
Partner with a CBK-licensed Payment Service Provider that already operates in Kenya and sit downstream of their licence. They handle the regulator-facing parts; you handle KRA-facing tax directly. This is the route for almost every SaaS, digital-content, e-commerce, course or marketplace business.
Apply for your own PSP authorisation from CBK: a Kenyan corporate vehicle, capital deposited locally, a board, a compliance officer and roughly a year of regulator engagement. This door is for companies that are payment infrastructure — gateways, wallets, remitters, BNPL and e-money issuers.
Most foreign merchants take door 1. Door 2 is for companies that are payment infrastructure. The framing matters, because the wrong door is enormously expensive in the wrong direction.
Door 1: working through a licensed local PSP
The realistic shortlist in 2026: Pesapal (oldest in market, deepest M-Pesa integration), Flutterwave (best for pan-African collection, will settle to a foreign bank account), DPO Pay (strong in hospitality and tourism, multi-currency settlement including USD, EUR and GBP), iPay Africa, Cellulant, and increasingly Kora.
Stripe still does not directly support M-Pesa or KES settlement as of 2026. Merchants who rely on Stripe alone lose the roughly 70%+ of the Kenyan checkout audience that defaults to mobile money, which is why the dual-gateway pattern — Stripe for cards, a local provider for M-Pesa — is so common.
- KYB on the foreign parent. Certificate of incorporation, UBO disclosure, directors’ IDs or passports, business website, sample contracts and estimated monthly volume.
- A payout destination. Flutterwave will settle to a foreign bank account for cross-border merchants; DPO and Pesapal historically prefer Kenyan settlement, which forces some local arrangement.
- Vertical clearance. CBD, gambling, forex, crypto, adult and most other high-risk categories are declined by these providers. Specialty acquiring exists, but Pesapal is not it.
- Fees, honestly. Roughly 1.4–2.0% on M-Pesa, 2.5–3.9% on cards, plus an FX margin on cross-border settlement that typically lands 200–400 bps above an EU equivalent. Settlement is T+1 to T+3 locally, slower cross-border.
Using a licensed PSP does not make your tax obligations to KRA disappear. The PSP collects the payment. It does not file your VAT or SEP return.
Door 2: direct CBK authorisation
You need this door if you are the payment service — running a wallet, a remittance corridor, a payment aggregator, a card-issuing programme, or a digital-lending product taking repayments through scheme rails. The legal anchor is the National Payment System Act, 2011 and the National Payment System Regulations, 2014, plus a stack of CBK circulars on top.
| Licence tier | Core capital | For |
|---|---|---|
| Electronic Retail PSP | KES 5M | Retail and e-commerce payment processing |
| Small E-Money Issuer | KES 1M | Wallets with capped transaction sizes (up to ~KES 10,000) |
| E-Money Issuer | KES 20M | General-purpose e-money |
| Designated Payment Instrument Issuer | KES 50M | Systemically larger players |
The application itself requires Form 1 (First Schedule, NPS Regulations 2014), a non-refundable KES 5,000 application fee, and — once CBK issues its Letter of Intent — a KES 100,000 authorisation fee. Three proposed business names are submitted upfront and reserved for 12 months.
- Letters of no objection from home-country regulators, plus board resolutions and CBK’s “regulatory cooperation guarantees” — an understanding that your home regulator will share supervisory information with CBK on request.
- A registered office in Kenya and a local compliance officer.
- A Kenyan tax compliance certificate, which requires a KRA PIN, which in turn requires either KenInvest endorsement (for investment above USD 100,000) or a Class G Investor Permit below that.
- A current credit rating report from a Kenyan credit reference bureau.
- A public-interest statement explaining how serving Kenyans benefits the local market. CBK’s National Payments Strategy explicitly favours applicants who incorporate Kenyan governance, hire locally and align with financial-inclusion goals.
Timeline in practice: 6–12 months from first engagement to authorisation, longer if CBK comes back with follow-up questions, which it usually does. Once authorised, the licensee must begin operations within 6 months or risk lapsing.
The KRA tax stack that catches most foreigners
This is where foreign merchants get hurt most often, because they treat the PSP integration as the finish line. It is not even half the work. Two taxes apply to non-residents earning revenue from Kenyan users, whether or not you have any physical presence in the country.
Effective SEP levy on gross Kenya revenue, alongside 16% VAT on digital services — no threshold since 1 July 2025, both filed monthly via iTax by the 20th.
Significant Economic Presence Tax (SEPT)
SEPT replaced the old 1.5% Digital Services Tax on 27 December 2024 under the Tax Laws (Amendment) Act 2024. The mechanics: deemed taxable profit is 10% of your gross Kenyan turnover, taxed at the 30% corporate rate — an effective 3% levy on gross Kenya revenue.
The Finance Act 2025, effective 1 July 2025, scrapped the KES 5 million annual threshold. There is now no de minimis: earn one dollar from a Kenyan user and you owe SEP tax on it.
A non-resident is treated as having significant economic presence if any one of these is true: the user accesses your service from a device in Kenya, pays with a card issued by a Kenyan financial institution, has a Kenyan IP address, or has a Kenyan billing or business address. Telecom operators and certain services to airlines in which the government holds at least 45% (effectively Kenya Airways) are exempt. KRA published draft SEPT Regulations on 22 September 2025, with final regulations expected in early 2026.
VAT on digital services
VAT at 16% applies in parallel to SEP — a different tax with a different mechanism. SEP is income tax paid by the foreign business; VAT is collected from the Kenyan customer and remitted.
The VAT-on-digital-services regime predates SEP (in force since 2020, broadened in 2023). The same no-threshold rule applies: a non-resident supplying digital services to Kenyan consumers must register from the first sale, not at KES 5 million.
Both taxes are filed monthly through KRA’s iTax portal, due by the 20th of the month after the supply. Non-resident registration uses a simplified online framework that issues a non-resident KRA PIN; alternatively you can appoint a Kenyan tax representative, which is easier if you want a local human handling iTax submissions and audit responses.
Penalties have teeth now
The penalty stack: 5% of the tax due or KES 10,000 (whichever is higher) for missed filings, 5–20% of unpaid tax plus 1% monthly interest, and — under international tax treaties — KRA can request enforcement help from your home country’s revenue authority.
KRA can instruct the Communications Authority of Kenya to block your platform for Kenyan users. By August 2025 it had collected KES 2.3 billion from 454 registered foreign providers, up from 178 in early 2025. Compliance is no longer theoretical — KRA is finding people.
One important nuance: SEP does not apply where the non-resident has a Permanent Establishment in Kenya. Set up a Kenyan subsidiary and you fall out of the SEP regime and into standard 30% corporate income tax on profits — usually worse for low-margin businesses but better for high-margin ones, because SEP taxes gross while corporate tax taxes net.
M-Pesa: the rail you cannot route around
About 70% of Kenyan adults use mobile money, and M-Pesa is the default. Building a Kenyan checkout that does not accept M-Pesa is roughly equivalent to building a US checkout that does not accept cards. People will leave the page.
Optimised for a customer who isn’t there
- ~70% of Kenyan adults default to mobile money, not cards
- Stripe does not support M-Pesa or KES settlement as of 2026
- Cross-border card authorisation is weak and issuer-dependent
- 3-D Secure times out on slow connections
- Most of the audience leaves before the payment step
Built on how Kenyans actually pay
- M-Pesa STK push: one PIN, no card number, no CVV
- Cards handled in parallel for the buyers who have them
- Reaches the ~70% that card-only checkouts miss
- Local rails settle in T+1 to T+3
- Routing through a licensed PSP keeps you downstream of their authorisation
There are two ways to integrate.
The direct path runs through Safaricom’s Daraja API: you apply for an M-Pesa Paybill or Till number, upgrade the account to “Head Office”, and link settlement to a Kenyan bank account. The whole flow assumes a Kenyan corporate entity. Foreign businesses can route through a Kenyan subsidiary or a local merchant partner, but Daraja directly is not designed for a non-Kenyan applicant.
The aggregator path runs through Flutterwave, Pesapal, DPO or Kora, who hold the Safaricom relationship. You sit upstream of their API and STK Push works through their infrastructure. Fees are 30–80 bps higher than direct Daraja, but you avoid the local-bank-account requirement and the reconciliation overhead.
Below roughly KES 30 million per month, the aggregator route almost always wins. Above it, building a direct Daraja integration starts to pay back — but it assumes a Kenyan corporate entity and a Kenyan bank account for settlement.
The compliance side-car
Three obligations live beside the CBK and KRA work and routinely get missed.
POCAMLA — the FRC obligations
Under the Proceeds of Crime and Anti-Money Laundering Act, PSPs and reporting institutions must register with the Financial Reporting Centre, file Suspicious Transaction Reports and keep KYC records.
Data Protection Act, 2019
Any business processing the personal data of Kenyan residents must register as a Data Controller or Processor with the ODPC. The Act’s reach is extraterritorial, so non-resident merchants are caught.
FATF grey-list scrutiny
Kenya was grey-listed by FATF in 2024 and remained there through 2025, tightening AML oversight generally and driving the VASP Act.
Crypto: the door that just closed
If your payment plan involves stablecoin on-ramps, crypto checkout or wallet custody, the Virtual Assets Service Providers Act, 2025 reshapes the field. Gazetted on 21 October 2025 and in force from 4 November 2025, it requires every Virtual Asset Service Provider operating in or from Kenya — exchanges, custodial wallets, crypto-accepting gateways, stablecoin issuers, brokers — to be licensed by CBK (for payments, custody and stablecoins) or by the Capital Markets Authority (for exchanges, tokenised assets and investment products).
As of November 2025 no VASP had been licensed, because the National Treasury has not yet issued the implementing regulations. If your model touches crypto on/off-ramps, stablecoin payments or custody, you cannot legally launch in Kenya right now. Wait for the regulations — likely early-to-mid 2026 — then decide.
The Act prohibits natural persons from operating as VASPs and requires a physical Kenyan office, and the Finance Act 2025 added a 10% excise duty on VASP fees. A foreign business that wants to accept crypto from Kenyan users in 2026 has three options: wait for the regulations and apply for a CBK or CMA licence through a Kenyan vehicle; integrate with a Kenyan-licensed VASP once one exists; or route flows through fiat on the standard PSP rails and convert outside Kenyan jurisdiction.
Decision tree: what to actually do
Pulling it together — what a foreign business should actually do depends on its setup.
| If you are… | What to do |
|---|---|
| A pure cross-border digital service (SaaS, streaming, courses, e-books) | Register with KRA under the simplified non-resident framework for SEP and VAT. Partner with a local PSP that can settle to a foreign bank account (Flutterwave is the common pick). Register as a Data Controller with the ODPC. No CBK licence required. |
| An e-commerce platform shipping physical goods | Same KRA registration and local PSP partnership, plus customs and import duty, and VAT on the imported goods at point of entry. |
| High volume, wanting your own MID and direct Daraja | Register a Kenyan subsidiary, move activities to the local entity, and exit SEP into standard 30% corporate tax. You are now a Kenyan company with a foreign parent. |
| A payment service business itself | Door 2. Plan for 9–12 months of CBK engagement, the relevant core capital, and a Kenyan structure with local governance and a compliance officer in Nairobi. |
| Crypto-touching | Hold until the VASP regulations are gazetted, then choose between your own licence and integrating with a Kenyan-licensed counterparty. |
The bottom line
The thing that trips up most foreign teams is treating Kenyan payment acceptance as a single problem with one provider on the other end of an API call. It is three problems running in parallel. CBK cares whether you are authorised to provide payment services. KRA cares whether you file and pay SEP and VAT every month. Safaricom cares whether your M-Pesa integration is technically legitimate. They do not coordinate with each other — you have to coordinate them yourself, and the cost of getting any one wrong does not show up until the demand notice arrives or the CAK blocks the domain.
Kenyan mobile money flows crossed KES 8 trillion in 2024 and are still growing. The market is worth the work — but the entry cost is real, and the right structure depends on what you sell and how much volume you push through the country.
Frequently asked questions
Do I need a CBK licence to accept payments from Kenyan customers?
I only use Stripe — is that enough for Kenya?
Does using a local PSP remove my Kenyan tax obligations?
Is there still a revenue threshold before Kenyan tax applies?
Can I accept crypto from Kenyan users right now?
Sources
Regulatory primary sources
- Central Bank of Kenya — PSP authorisation procedures and checklist (centralbank.go.ke)
- National Payment System Act, 2011 and National Payment System Regulations, 2014
- Tax Laws (Amendment) Act, 2024 — introduced SEPT (effective 27 December 2024)
- Finance Act, 2025 — removed the SEP threshold, introduced the VASP excise (effective 1 July 2025)
- Draft Income Tax (Significant Economic Presence Tax) Regulations, 2025 (KRA, 22 September 2025)
- Virtual Assets Service Providers Act, 2025 — gazetted 21 October 2025, in force 4 November 2025
- Joint CBK/CMA public notice on commencement of the VASP Act, 18 November 2025
- Data Protection Act, 2019 (Office of the Data Protection Commissioner)
Commentary and practitioner analysis
- EY Global Tax Alert — KRA publishes draft SEPT regulations (September 2025)
- BDO East Africa — Understanding Significant Economic Presence Tax (January 2025)
- BDO Global — Kenya: Draft SEP Regulations (November 2025)
- CM Advocates LLP — Obtaining a PSP Licence in Kenya (July 2025); Crypto Alert: the VASP Act 2025 (October 2025)
- KDS Advocates — Registration Process for Payment Service Providers in Kenya (July 2025)
- VATCalc — Kenya replaces Digital Services Tax with SEP tax 2025
- TechTrends Kenya — KRA Digital Tax Collection Hits Sh2.3 Billion (September 2025)
- Flutterwave developer documentation — M-Pesa integration reference
- PayAtlas — Accepting Payments in Kenya: PSPs, Compliance & Fees (January 2026)