Kenya has 1.6 million retail investor accounts on the Nairobi Securities Exchange. Fewer than 40,000 of those accounts were actively trading each month as of 2024, according to NSE data reported by Semafor. The gap between those two numbers tells you everything about why app-based platforms, aggregator services and robo-advisors have become so important to Kenya’s capital markets story. They’re the on-ramp.
And now, for the first time, they need their own licence to operate.
The Capital Markets (Licensing Requirements) (General) Regulations, 2025, gazetted on 11 December 2025, repeal the old 2002 licensing framework entirely. Among the most significant additions are two new licence categories: one for intermediary service platform providers (ISPPs), covering the aggregator apps that market, distribute and funnel users into capital markets products; and an expanded definition of ‘investment advisor’ that now captures robo-advisors providing automated, algorithm-driven advice. For anyone comparing legit trading platforms in kenya, these new rules change the criteria for what ‘legit’ actually means.
Here’s what the new permits require, how compliance will work in practice and what the penalties look like for platforms that don’t get on board.
What the New Licence Categories Actually Require
The 2025 Regulations, analysed in detail by Bowmans Kenya, draw a clear line between two types of digital platform.
The first is the intermediary service platform provider. The CMA defines this as an operator of ‘a digital application or otherwise which facilitates aggregation, marketing and distribution of capital markets products and services.’ In plain terms, if your app collects users and directs them toward trading products, investment schemes or brokerage services, you now need a standalone ISPP licence from the CMA.
Previously, these platforms operated through partnership agreements with existing licensees. The app did the marketing and onboarding; the licensed partner handled the regulatory side. It worked, technically. But it left the CMA one step removed from the entity that actually held the customer relationship.
I&M Capital Limited, a subsidiary of I&M Group PLC, became the first firm to receive an ISPP licence in February 2026, according to The Kenyan Wall Street. Their platform will support collective investment schemes and fixed-income instruments, giving a concrete example of how this licence category functions in practice.
The second path covers robo-advisors. These platforms use algorithms to build and manage portfolios (at low cost) and they’ve gained traction among younger, more passive investors who prefer simple digital tools.The CMA has actually introduced an approval-in-principle stage. Applicants who meet most requirements can receive a provisional green light valid for six months, during which they set up systems and hire staff but cannot take on clients. It replaces the previous all-or-nothing approach, which demanded full investment before any regulatory certainty.
The timing matters, too. In the same month the regulations were published, the CMA licensed Capital.com and XM as online forex brokers, adding two global names to Kenya’s growing list of authorised FX and CFD providers. Earlier licences for firms like Exness, IC Markets, FP Markets and FXPesa had already started shifting Kenya’s forex market from a largely offshore model to an onshore, CMA-supervised one. The ISPP and robo-advisory categories extend that same logic to the apps and digital tools that sit between retail users and the platforms themselves.
The Real Compliance Challenge for Aggregator Apps
Getting a licence is one thing. Maintaining compliance is another, and for many aggregator apps the operational costs may prove more demanding than the capital thresholds.
Under the 2025 Regulations, all licensees must now submit monthly risk-based capital adequacy reports to the CMA. ISPP holders face quarterly reporting obligations on top of that, and Regulation 36 requires them to give three months’ notice before ending any partnership with a licensed entity, including reasons, a transition procedure and timelines for client handover.
Fund managers saw their paid-up share capital requirement double from KES 10 million to KES 20 million. Investment advisor annual renewal fees went from KES 50,000 to KES 100,000. These aren’t prohibitive numbers for established financial institutions, but for the lean, tech-first aggregator apps that grew by keeping overheads low, they represent a different way of doing business.
The key compliance obligations for ISPP licence holders include:
- Holding the prescribed minimum capital and meeting ongoing liquidity thresholds
- Filing monthly risk-based capital adequacy reports with the CMA
- Submitting quarterly operational reports specific to the ISPP category
- Maintaining a physical presence and qualified compliance personnel in Kenya
- Providing structured exit procedures (three months’ notice) when ending partnerships with licensed entities
There’s an important carve-out, though. Entities that already hold a CMA licence for the same activities don’t need a separate ISPP licence. That gives banks, licensed brokers and fund managers an inbuilt competitive advantage. They can offer platform services under their existing authorisation while pure-play aggregator apps navigate the new process from scratch.
Existing licensees have until 11 December 2026 to comply with the updated requirements. That sounds like a generous runway, but compliance infrastructure (legal counsel, reporting systems, qualified officers) takes time to build. Nine months is shorter than it sounds.
Consider, too, that local investor participation at the NSE reached a 15-year high in September 2025, with domestic activity accounting for nearly 72% of total trading, according to CMA data reported by The Kenyan Wall Street. The retail side of Kenya’s capital markets is growing, and the platforms serving it are under more scrutiny than ever. Compliance costs will feel heavier for smaller operators, but they also represent a credibility signal to the very users those platforms are trying to attract.
What Non-Compliance Actually Costs
The Capital Markets Act carries real consequences for platforms that operate without proper licensing.
Section 34(2) of the Act provides that any person who contravenes its provisions faces imprisonment for up to five years, a fine of up to KES 15 million (roughly $116,000 at current rates), or both. Section 34A allows the CMA to impose administrative financial penalties of up to KES 10 million on institutions and KES 5 million on individuals, without needing a court conviction.
Beyond fines and prison time, the CMA’s enforcement toolkit includes licence suspension or revocation, cease-and-desist orders, public censure and referral to the Director of Public Prosecutions for criminal proceedings, as outlined in a 2025 analysis by O’Bang Law. The authority has used these powers before. In 2018, it issued a cease-and-desist order against Pesos Capital Markets Limited for operating as a fund manager and online forex dealer without the required licences.
For aggregator apps that currently route Kenyan retail traders toward offshore brokers, the new ISPP requirement raises a pointed question. If the CMA treats this funnelling activity as falling within the ISPP definition (and the regulatory language suggests it does), then unlicensed aggregators face enforcement action regardless of whether the end broker is regulated elsewhere.
With 75% of Kenya’s population under 35 and 56 million active mobile subscriptions driving a 30% rise in retail forex trading since 2023, according to Capital FM, the audience for these platforms is large and growing. If enforcement pushes unlicensed apps out, where do those young traders go?
The Clock is Running, and That’s a Good Thing
Kenya’s 2025 Regulations are the regulator catching up with reality. Retail trading in this country happens through apps, algorithms and mobile phones. It has for years. The ISPP and robo-advisory licence categories finally put a regulatory frame around how these platforms actually work, rather than relying on partnership workarounds that left the CMA at arm’s length from the platforms with the closest customer contact.
The 11 December 2026 compliance deadline will separate platforms willing to invest in proper licensing from those that aren’t. For the millions of young Kenyans whose first experience of capital markets comes through a phone screen, that separation matters. It determines whether their entry point is supervised, capitalised and accountable, or whether it sits in a gap that the regulator has now explicitly closed.
Safaricom’s recent launch of its Ziidi Trader mini-app through M-Pesa, enabling stock trading directly from mobile money wallets, shows the direction this market is heading. The NSE has also licensed Airtel to offer similar services. Regulated, mobile-first access to capital markets is becoming the norm rather than the exception.
With the licensing infrastructure in place, will Kenya become the benchmark for how African regulators bring app-based trading under proper oversight without choking the mobile-first access that made it possible in the first place?
Email your news TIPS to Editor@nairobilawmonthly.com, and to advertise with us, call +254715061658 anytime of the day
