Africa Digest News

Launching a financial product in Kenya without a licence is illegal, but getting a licence before you’ve proven your product works is a Catch-22 for early-stage startups. Kenya’s regulatory sandbox was designed to solve exactly this problem.

Here’s everything you need to know about how it works, who runs it, and whether your startup qualifies.

What Is a Regulatory Sandbox?

A regulatory sandbox is a controlled environment where fintech startups can test innovative products and services with real users, under regulatory supervision, before going through the full licensing process.

Think of it as a supervised pilot: you get to operate in the market, but with a watchful regulator by your side.

The concept dates back to M-Pesa’s own origins. When Safaricom launched M-Pesa in 2007, there was no formal framework for mobile money.

The CBK and Communications Authority allowed it to operate under a flexible, test-and-learn approach. That informal sandbox spirit is now formalised in Kenya’s regulatory architecture.

Who Runs Kenya’s Fintech Sandbox?

Kenya has two primary sandbox operators:

1. The Capital Markets Authority (CMA) Sandbox

The CMA launched its regulatory sandbox in 2019, making it one of the first in East Africa. It targets fintech innovations in the capital markets space, including crowdfunding platforms, investment apps, digital securities, P2P lending platforms that resemble securities, and robo-advisors.

Startups admitted to the CMA sandbox get a 12-month live testing period with specific regulatory requirements relaxed. They operate under a special dispensation, not a full licence, but enough to run a real product with real customers.

Notable CMA sandbox graduates include Pezesha Africa, a debt crowdfunding platform that successfully exited the sandbox and received full regulatory clearance to operate.

2. CBK (Central Bank of Kenya) Sandbox

The CBK oversees payment systems, digital lending, and banking services. While the CBK has historically taken a test-and-learn approach (as with M-Pesa), it has been slower to formalise a dedicated sandbox compared to the CMA.

A multi-sector sandbox bringing together CBK and CMA for cryptocurrencies and payment technologies has been under exploration, particularly relevant now that VASPA is in force.

READ ALSO :Kenya’s Virtual Asset Service Providers Act (VASPA) Explained Simply

Fintechs regulated by multiple bodies, such as a mobile network operator running a payment service, may face oversight from both the CBK and the Communications Authority simultaneously.

Who Qualifies for the CMA Sandbox?

To be considered for the CMA sandbox, your startup generally needs to demonstrate:

• A genuinely innovative product: the solution must go beyond what existing licensed players already offer.
• A connection to capital markets: your product must deepen or improve Kenya’s capital markets in a meaningful way.
• A credible business plan: you need to show the commercial viability of your product.
• Consumer safeguards: how will you protect users during the testing period?
• An exit strategy: what happens when the testing period ends? Will you apply for a full licence?

The CMA reviews applications on a rolling basis. Accepted applicants are given defined testing parameters, including user limits, transaction caps, and reporting requirements, to contain risk during the pilot.

What Happens After the Sandbox?

Sandbox participants have three possible outcomes at the end of the testing period:

1. Full licence granted: the product proved viable and compliant, and the startup can operate at full scale.
2. Extended testing: more time is granted to resolve outstanding issues.
3. Permission denied: if the product doesn’t meet regulatory requirements, the sandbox exit is a stop order.

Practical Advice for Startup Founders

• Know your regulator. Payment-related products go through CBK; investment and market products go through CMA. Some products may need both.
• Apply early. Regulatory engagement takes time. Begin conversations with the relevant authority before you build. Regulators prefer to shape products from the start rather than review them after launch.
• Document everything. Your sandbox application will require detailed technical documentation, legal structure, and consumer protection policies.
• Get legal counsel. The regulatory landscape in Kenya is complex and evolving rapidly, especially with VASPA now in force. A fintech lawyer is not optional.

Kenya’s sandbox model is a genuine competitive advantage for the ecosystem. It allows innovation to breathe while keeping consumers protected.

If you’re building something genuinely new in Kenyan finance, the sandbox may be your fastest legal path to market.