Jira & Confluence 
Bitrix24 CBK Non-Deposit Taking Credit Providers Regulations, 2026
Loan app harassing you or calling your contacts? — complaint letter ready, deadlines counted
Short answer. The complaint is already open below: list the calls and messages, add your loan details and send it to the lender. Debt collection that is banned: Threats; obscene or shaming messages to you or your contacts; using your phone book to message contacts; posting your details online; unsolicited calls to your contacts; harassment; calls outside working hours (LN 191/2026, reg. 30(1)).
- Lender must acknowledge your complaint (if it cannot resolve it at once): within 7 days: type the date
- Lender must answer your request to erase your contacts and data: within 14 days: type the date
- Lender must resolve the complaint: within 30 days — after that you can complain to the CBK: type the date
Check your own case.
Regulation 40(3) and (5) of the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026: acknowledgement within seven days of receipt, resolution within thirty days of the customer reporting the complaint. Regulation 12(3) of the Data Protection (General) Regulations, 2021: a reply to an erasure request within fourteen days. We count calendar days and do not move dates that fall on a weekend or public holiday.
Start typing right in the document — no sign-up. It stays in this browser; save it to your free Layers account to keep it, open it on your phone and share it.
Lida, Layers template assistant
Start with the table: one row per call or message, with the date, time and number. Facts like these are hard for a lender to ignore.
Send the letter in writing and keep proof of the date — the 7 and 30 days count from when the lender receives it.
An illustrated character, not a lawyer.
Deadlines
The rules, with the source
| What | Deadline | Source |
|---|---|---|
| Debt collection that is banned | Threats; obscene or shaming messages to you or your contacts; using your phone book to message contacts; posting your details online; unsolicited calls to your contacts; harassment; calls outside working hours | LN 191/2026, reg. 30(1) |
| Sharing your information | Only with your express consent or where a law requires or permits it | LN 191/2026, reg. 32(2) |
| Who collects the debt | If collection is outsourced, you must be told who collects and how before collection starts | LN 191/2026, reg. 44 |
| Acknowledgement of your complaint | Within 7 days of receipt (if not resolved at once) | LN 191/2026, reg. 40(3) |
| Resolution of your complaint | Immediately, or within 30 days of reporting it | LN 191/2026, reg. 40(5) |
| If not resolved | Complain to the Central Bank of Kenya | LN 191/2026, reg. 50(2)–(3) |
| Negative CRB listing | Written or recorded electronic notice at least 30 days before, or a shorter period set in your loan contract (never less than 7 days where repayments fall due at intervals under 30 days); no negative listing for KES 1,000 or less | LN 191/2026, reg. 33(3) and 33(6) |
| Interest on a non-performing loan | Interest recoverable cannot exceed the principal owing when the loan became non-performing | LN 191/2026, reg. 29 |
| Erasure of your data | Reply within 14 days | Data Protection (General) Regulations, 2021, reg. 12(3) |
| Complaint to the Data Commissioner | Acknowledged within 7 days; investigated and concluded within 90 days | Complaints Regulations, 2021, reg. 4(4); Data Protection Act, s.56(5) |
The 2026 Regulations (Legal Notice 191 of 2026) were published and came into force on 29 September 2026 and revoked the Digital Credit Providers Regulations, 2022. Lenders licensed under the 2022 rules are deemed licensed under the new ones (reg. 96(4)). Banks, microfinance banks and Saccos are outside these Regulations (reg. 3(3)).
Step by step
What to do, in order
1
Save the evidence
Screenshot every message, note the time and number of every call, and ask the contacts who were called to send you screenshots too.
2
Fill in the letter
Use the lender's registered company name, your loan number and one row per call or message.
3
Send it and keep proof
E-mail it and log it in the app's complaints section. Keep the sent e-mail and the ticket number.
4
Watch the 7 and 30 days
Enter the date the lender received your complaint: we show both deadlines.
5
Escalate
No answer, or still harassed? Complain to the Central Bank of Kenya with this letter, and to the Data Commissioner about your contacts. Report threats of violence to the police.
Questions
Are the 2022 digital lender rules still in force?
No. They were revoked on 29 September 2026 by the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026. The ban on contacting your phone contacts and on shaming borrowers is now in regulation 30(1) of the new rules.
Do I have to pay the loan anyway?
Yes — a complaint about harassment does not cancel a debt you owe. But the lender may only collect lawfully, must not charge fees that were not in your loan agreement, and on a non-performing loan cannot recover interest above the principal owing.
Can I go straight to the CBK?
The Regulations say a customer shall first lodge the complaint with the lender and may complain to the CBK if it is not resolved. That is why the letter comes first: it starts the 30 days.
Official sources
- The Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026 — Legal Notice 191 of 2026 — regs. 3, 29, 30, 32, 33, 39, 40, 41, 44, 50, 96, 97 (Kenya Law)
- Data Protection Act, 2019 (Cap. 411C) — ss.26, 40, 56 (Kenya Law)
- Data Protection (General) Regulations, 2021 — regs. 9, 12 (Kenya Law)
- Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 — reg. 4 (Kenya Law)
Other documents
Keep the papers in one place
Letters, receipts and notices in one folder you can share with family or a lawyer. The templates and the editor are free; Layers is free for up to 20 people.
This is a ready document and a deadline calculation, not legal advice.