MNL ADVOCATES LLP (MN LEGAL)

Blog

  • Filing From Abroad: What Kenya’s Finance Act, 2026 Means for Non-Resident Landlords

    Filing From Abroad: What Kenya’s Finance Act, 2026 Means for Non-Resident Landlords

    MN Legal Insights

    A business can pay for a genuine expense, record it correctly and still land in a tax compliance problem. Here is why Kenya’s eTIMS compliance rules, and their effect on tax deductibility, deserve your attention long before the return is filed.

    Picture Achieng, the finance manager of a growing Nairobi company. In March, her company buys office equipment worth KSh 250,000. The supplier delivers on time, the bank transfer goes through, and Achieng files the purchase order, the signed delivery note and the proof of payment in neat order. When the supplier mentions that he will send the eTIMS invoice “later”, she nods. She has a hundred other things to do, and the books already balance.

    Months pass. Then the income tax return comes up, and with it an uncomfortable question: if KRA looks at this purchase, will it find what it expects to find?

    That question carries far more weight today than it did two years ago, because the Kenya Revenue Authority (KRA) no longer takes a return at face value. It checks it. This is Achieng’s story, and quietly, it is the story of almost every business in Kenya.

    Two sets of eyes on the same expense

    An accountant and a tax officer can look at the same KSh 250,000 and ask different questions. The accountant asks whether the transaction was recognised and recorded properly. The tax officer asks whether it can be deducted, and whether the paper behind it says so in the way the law requires.

    Section 15 of the Income Tax Act allows businesses to deduct expenditure incurred in producing income, subject to the Act’s conditions, while section 16 lists what cannot be deducted. Since the Finance Act 2023, electronic invoicing through KRA’s electronic Tax Invoice Management System (eTIMS) has been woven into that picture. KRA’s guidance states that from 1 January 2024, business expenditure generally has to be supported by an electronic tax invoice to qualify for deduction, subject to the exceptions in the law.

    Achieng’s books answer the first question beautifully. The second hangs on a document she does not yet have.

    A reliable accounting entry is only one part of a defensible tax deduction.

    In fairness to the invoice, it cannot do everything. An eTIMS invoice does not make an expense deductible by itself. The expense must still be genuine, incurred for business purposes and properly classified. What the invoice does is prove the transaction to the tax authority in the form it expects.

    The year the return met the records

    For years, preparing the annual return meant gathering the books, adjusting for items that could not be deducted, and filing. That work still matters. What has changed is that somebody else now holds a copy of your transactions.

    In a public notice dated 10 November 2025, KRA announced that from 1 January 2026 it would validate the income and expenses declared in individual and non-individual income tax returns against three sources: TIMS/eTIMS records, withholding income tax gross amounts and customs import records. The checks began with returns for the 2025 year of income. The notice adds that declared figures must be supported by valid electronic tax invoices, correctly transmitted with the buyer’s PIN where applicable, subject to the exceptions in section 23A of the Tax Procedures Act and the Tax Procedures (Electronic Tax Invoice) Regulations, 2024.

    Then, in June 2026, came a breathing space. KRA allowed taxpayers filing 2025 returns to declare valid business expenses that lacked eTIMS invoices, uploading them at filing for validation afterwards. But the allowance covered 2025 only. From the 2026 year of income onwards, declared income and expenses must be backed by valid electronic invoices generated and transmitted through TIMS/eTIMS, subject to the legal exceptions. The relief was a bridge, not a destination, and anyone keeping 2026 records is already standing on the far side of it.

    None of this means that a mismatch is a finding of fraud, or that the expense is automatically lost. It means the business must be able to explain the difference. Explaining it at the time of purchase takes one phone call. Explaining it a year later can take weeks.

    “But we are not VAT-registered”: who must issue eTIMS invoices

    It is the sentence we hear most often, and it is the most expensive misunderstanding in this whole area.

    Electronic invoicing is not a VAT matter. Following the Finance Act 2023, it extends to persons carrying on business, whether or not they are registered for VAT. A consultancy, a retailer or a property business may carry eTIMS obligations even if it never charges a shilling of VAT. And as a buyer, each of them needs its suppliers’ invoices to support its own deductions. VAT registration and eTIMS compliance are separate questions with separate answers.

    That is why eTIMS has stopped being a job for the tax desk alone. It reaches procurement, accounts payable, supplier selection and the filing cabinet. If you are a smaller business still finding its feet in Kenya, our legal roadmap for SMEs entering the Kenyan market is a useful companion read.

    Why a bank transfer is not an eTIMS invoice

    Back to Achieng’s folder. She has a bank transfer, a delivery note and a purchase order. Each tells part of the story: money moved, goods arrived, somebody approved. But none of them is the document the rules ask for.

    A valid electronic tax invoice carries prescribed information. KRA’s guidance points to the seller’s PIN, the date and time of issue, the buyer’s PIN where applicable, a description and quantity of what was supplied, the invoice identifiers and QR code, and the tax rate, tax amount and total. The exact requirements depend on the regulations and the invoicing system in use.

    When an invoice does arrive, a careful buyer reads it the way a pilot reads a checklist. Are the supplier and buyer details right, including the buyer’s PIN? Do the description and amount match what was actually bought? Is the invoice genuine? KRA advises scanning the QR code or using the invoice number checker on iTax. And does it agree with the purchase order, the delivery note and the payment record? A few minutes of checking at the time can save weeks of reconstruction later.

    When the supplier will not, or cannot, play along on eTIMS

    Every finance team meets this supplier eventually: the small trader with a handwritten receipt, or the service provider who has never heard of eTIMS. The transaction is real. So is the compliance problem.

    The instinct is to walk away from the supplier or write off the expense. Resist both. Begin by asking for a compliant invoice, and give the supplier your correct business name and PIN. When it arrives, verify it. If something is wrong, such as a mistaken PIN or amount, the fix normally runs through a credit note and a reissued invoice, not through a pen or an edited spreadsheet. Then check whether the purchase falls within an exclusion at all. And whatever happens, keep the trail: the purchase order, the contract, proof of delivery or completion, payment records and every message exchanged with the supplier. That trail shows what happened. But where no exclusion applies, it does not replace the invoice the law requires.

    For the smallest suppliers, there is a purpose-built route. Where the seller is a small business or small-scale farmer with annual turnover not exceeding KSh 5 million, the buyer can raise the invoice on the seller’s behalf, as a buyer-initiated eTIMS invoice, through the eCitizen platform, so the purchase can be substantiated as a business expense. The seller is notified and must approve the invoice before it is transmitted through eTIMS, so the buyer needs accurate transaction details and the seller’s cooperation, and should confirm that both the supplier and the transaction qualify. This is different from reverse invoicing, which suits structured businesses with many small suppliers and needs a billing system integrated with eTIMS, together with KRA’s approval.

    Neither route is a licence to create paperwork for something that never happened, or to manufacture documents after the fact. They exist to record real transactions, not to rescue missing ones.

    Not every expense needs an eTIMS invoice: the exclusions

    The law is not absolute here. Regulation 10 of the 2024 regulations, as summarised in KRA’s guidance, excludes a list of transactions from the electronic invoice requirement. These include emoluments such as salaries and wages, imports, investment allowances including internal accounting adjustments, airline passenger ticketing, interest and fees charged by financial institutions, expenses subject to withholding tax that is a final tax, services provided by a non-resident without a permanent establishment in Kenya, and other exclusions under section 23A of the Tax Procedures Act. For employee costs, which sit outside the invoice requirement, our guide to payroll compliance when hiring your first employee covers the payroll obligations that apply instead.

    Two cautions apply. First, the withholding tax exclusion is narrow: it covers withholding tax that is a final tax, not every expense from which tax has been withheld. Second, being excluded from electronic invoicing is not the same as being deductible, because the ordinary income tax rules still apply. The discipline is to classify the expense, establish its legal treatment, and keep the records that support your conclusion.

    Making eTIMS compliance a habit

    The businesses that cope best with eTIMS rarely scramble at filing time. They have turned invoice checks into a habit that runs alongside the buying itself. They identify which purchases need an electronic invoice and which are excluded. They verify supplier details, buyer PIN and transmission status when the invoice arrives. They reconcile invoices with purchase orders, delivery notes, supplier statements and the ledger. They resolve gaps while the supplier is still easy to reach. And they document everything, including the reason for any exclusion they rely on. A smaller firm can begin with a structured spreadsheet and a monthly review, while a larger one can build the same checks into procurement policy, supplier contracts, payment approvals and system controls.

    Before filing, one last walk-through pays for itself. Does declared income reconcile with sales records and eTIMS data? Are purchases backed by invoices or by a recognised exclusion? Do withholding tax records agree with what was declared? Is import expenditure supported by customs documents? Have cancelled, duplicate and corrected invoices been handled properly? A difference is not proof that an expense is invalid, but it is a reason to look before KRA does.

    Two endings for Achieng

    Suppose the supplier never sends that invoice, and no exclusion applies. The KSh 250,000 expense may be disallowed. At the 30% corporate rate, that is roughly KSh 75,000 of additional tax, before any penalties and interest.

    Now imagine a second version of the story. Achieng’s company has one simple rule: no supplier is paid until a verified eTIMS invoice is on file. The invoice is requested on delivery, checked against its QR code, matched to the purchase order and filed with the payment. When return time arrives, the deduction is already defensible.

    Same equipment. Same money. The only thing that changed was the process.

    The invoice is part of the control system

    An electronic tax invoice looks like a small administrative document. In practice, it links the supplier’s sale to the buyer’s records and feeds the data KRA uses to check returns. It does not make every expense deductible, and a discrepancy does not make every expense disallowed. What has changed is that records must now be reconcilable, verifiable and explainable.

    One transaction. Two sides of the ledger. One invoice that matters to both.

    eTIMS and tax deductibility: quick answers

    Does an eTIMS invoice make an expense tax deductible?

    No, not by itself. The expense must still be genuine, incurred for business purposes and properly classified. What the eTIMS invoice does is prove the transaction to KRA in the form it expects.

    Do I need eTIMS invoices if I am not VAT-registered?

    Possibly, yes. Electronic invoicing extends to persons carrying on business whether or not they are registered for VAT, and as a buyer you need your suppliers’ invoices to support your own deductions.

    What if my supplier will not issue an eTIMS invoice?

    Ask for a compliant invoice with your correct business name and PIN, verify it, and check whether the purchase falls within an exclusion. For small suppliers with annual turnover not exceeding KSh 5 million, the buyer can raise the invoice through eCitizen, subject to the seller’s approval. Keep the full paper trail either way.

    Which expenses are excluded from the eTIMS invoice requirement?

    The list includes salaries and wages, imports, airline passenger ticketing, interest and fees charged by financial institutions, expenses subject to final withholding tax, and services from non-residents without a permanent establishment in Kenya. An exclusion from invoicing is not the same as a deduction, because the ordinary income tax rules still apply.

    From when must declared expenses be backed by eTIMS invoices?

    KRA allowed a one-off relief for 2025 returns. From the 2026 year of income onwards, declared income and expenses must be supported by valid electronic invoices generated and transmitted through TIMS/eTIMS, subject to the legal exceptions.

    Is your business ready for eTIMS validation?

    If you are unsure whether your invoicing records are complete, how supplier expenses should be treated, or whether your books reconcile with KRA’s data, a structured compliance review can find the gaps and set out practical fixes.

    MN Legal advises businesses on Kenyan tax compliance, legal risk management and the controls that support responsible operations.

    Contact MN Legal to discuss an eTIMS compliance review, invoice and expense reconciliation, or practical tax documentation procedures for your business.

  • Beyond the Invoice: How eTIMS Compliance Affects Tax Deductibility in Kenya

    Beyond the Invoice: How eTIMS Compliance Affects Tax Deductibility in Kenya

    A business can pay for a genuine expense, record it correctly and still land in a tax compliance problem. Here is why Kenya’s eTIMS compliance rules, and their effect on tax deductibility, deserve your attention long before the return is filed.

    Picture Achieng, the finance manager of a growing Nairobi company. In March, her company buys office equipment worth KSh 250,000. The supplier delivers on time, the bank transfer goes through, and Achieng files the purchase order, the signed delivery note and the proof of payment in neat order. When the supplier mentions that he will send the eTIMS invoice “later”, she nods. She has a hundred other things to do, and the books already balance.

    Months pass. Then the income tax return comes up, and with it an uncomfortable question: if KRA looks at this purchase, will it find what it expects to find?

    That question carries far more weight today than it did two years ago, because the Kenya Revenue Authority (KRA) no longer takes a return at face value. It checks it. This is Achieng’s story, and quietly, it is the story of almost every business in Kenya.

    Two sets of eyes on the same expense

    An accountant and a tax officer can look at the same KSh 250,000 and ask different questions. The accountant asks whether the transaction was recognised and recorded properly. The tax officer asks whether it can be deducted, and whether the paper behind it says so in the way the law requires.

    Section 15 of the Income Tax Act allows businesses to deduct expenditure incurred in producing income, subject to the Act’s conditions, while section 16 lists what cannot be deducted. Since the Finance Act 2023, electronic invoicing through KRA’s electronic Tax Invoice Management System (eTIMS) has been woven into that picture. KRA’s guidance states that from 1 January 2024, business expenditure generally has to be supported by an electronic tax invoice to qualify for deduction, subject to the exceptions in the law.

    Achieng’s books answer the first question beautifully. The second hangs on a document she does not yet have.

    A reliable accounting entry is only one part of a defensible tax deduction.

    In fairness to the invoice, it cannot do everything. An eTIMS invoice does not make an expense deductible by itself. The expense must still be genuine, incurred for business purposes and properly classified. What the invoice does is prove the transaction to the tax authority in the form it expects.

    The year the return met the records

    For years, preparing the annual return meant gathering the books, adjusting for items that could not be deducted, and filing. That work still matters. What has changed is that somebody else now holds a copy of your transactions.

    In a public notice dated 10 November 2025, KRA announced that from 1 January 2026 it would validate the income and expenses declared in individual and non-individual income tax returns against three sources: TIMS/eTIMS records, withholding income tax gross amounts and customs import records. The checks began with returns for the 2025 year of income. The notice adds that declared figures must be supported by valid electronic tax invoices, correctly transmitted with the buyer’s PIN where applicable, subject to the exceptions in section 23A of the Tax Procedures Act and the Tax Procedures (Electronic Tax Invoice) Regulations, 2024.

    Then, in June 2026, came a breathing space. KRA allowed taxpayers filing 2025 returns to declare valid business expenses that lacked eTIMS invoices, uploading them at filing for validation afterwards. But the allowance covered 2025 only. From the 2026 year of income onwards, declared income and expenses must be backed by valid electronic invoices generated and transmitted through TIMS/eTIMS, subject to the legal exceptions. The relief was a bridge, not a destination, and anyone keeping 2026 records is already standing on the far side of it.

    None of this means that a mismatch is a finding of fraud, or that the expense is automatically lost. It means the business must be able to explain the difference. Explaining it at the time of purchase takes one phone call. Explaining it a year later can take weeks.

    “But we are not VAT-registered”: who must issue eTIMS invoices

    It is the sentence we hear most often, and it is the most expensive misunderstanding in this whole area.

    Electronic invoicing is not a VAT matter. Following the Finance Act 2023, it extends to persons carrying on business, whether or not they are registered for VAT. A consultancy, a retailer or a property business may carry eTIMS obligations even if it never charges a shilling of VAT. And as a buyer, each of them needs its suppliers’ invoices to support its own deductions. VAT registration and eTIMS compliance are separate questions with separate answers.

    That is why eTIMS has stopped being a job for the tax desk alone. It reaches procurement, accounts payable, supplier selection and the filing cabinet. If you are a smaller business still finding its feet in Kenya, our legal roadmap for SMEs entering the Kenyan market is a useful companion read.

    Why a bank transfer is not an eTIMS invoice

    Back to Achieng’s folder. She has a bank transfer, a delivery note and a purchase order. Each tells part of the story: money moved, goods arrived, somebody approved. But none of them is the document the rules ask for.

    A valid electronic tax invoice carries prescribed information. KRA’s guidance points to the seller’s PIN, the date and time of issue, the buyer’s PIN where applicable, a description and quantity of what was supplied, the invoice identifiers and QR code, and the tax rate, tax amount and total. The exact requirements depend on the regulations and the invoicing system in use.

    When an invoice does arrive, a careful buyer reads it the way a pilot reads a checklist. Are the supplier and buyer details right, including the buyer’s PIN? Do the description and amount match what was actually bought? Is the invoice genuine? KRA advises scanning the QR code or using the invoice number checker on iTax. And does it agree with the purchase order, the delivery note and the payment record? A few minutes of checking at the time can save weeks of reconstruction later.

    When the supplier will not, or cannot, play along on eTIMS

    Every finance team meets this supplier eventually: the small trader with a handwritten receipt, or the service provider who has never heard of eTIMS. The transaction is real. So is the compliance problem.

    The instinct is to walk away from the supplier or write off the expense. Resist both. Begin by asking for a compliant invoice, and give the supplier your correct business name and PIN. When it arrives, verify it. If something is wrong, such as a mistaken PIN or amount, the fix normally runs through a credit note and a reissued invoice, not through a pen or an edited spreadsheet. Then check whether the purchase falls within an exclusion at all. And whatever happens, keep the trail: the purchase order, the contract, proof of delivery or completion, payment records and every message exchanged with the supplier. That trail shows what happened. But where no exclusion applies, it does not replace the invoice the law requires.

    For the smallest suppliers, there is a purpose-built route. Where the seller is a small business or small-scale farmer with annual turnover not exceeding KSh 5 million, the buyer can raise the invoice on the seller’s behalf, as a buyer-initiated eTIMS invoice, through the eCitizen platform, so the purchase can be substantiated as a business expense. The seller is notified and must approve the invoice before it is transmitted through eTIMS, so the buyer needs accurate transaction details and the seller’s cooperation, and should confirm that both the supplier and the transaction qualify. This is different from reverse invoicing, which suits structured businesses with many small suppliers and needs a billing system integrated with eTIMS, together with KRA’s approval.

    Neither route is a licence to create paperwork for something that never happened, or to manufacture documents after the fact. They exist to record real transactions, not to rescue missing ones.

    Not every expense needs an eTIMS invoice: the exclusions

    The law is not absolute here. Regulation 10 of the 2024 regulations, as summarised in KRA’s guidance, excludes a list of transactions from the electronic invoice requirement. These include emoluments such as salaries and wages, imports, investment allowances including internal accounting adjustments, airline passenger ticketing, interest and fees charged by financial institutions, expenses subject to withholding tax that is a final tax, services provided by a non-resident without a permanent establishment in Kenya, and other exclusions under section 23A of the Tax Procedures Act. For employee costs, which sit outside the invoice requirement, our guide to payroll compliance when hiring your first employee covers the payroll obligations that apply instead.

    Two cautions apply. First, the withholding tax exclusion is narrow: it covers withholding tax that is a final tax, not every expense from which tax has been withheld. Second, being excluded from electronic invoicing is not the same as being deductible, because the ordinary income tax rules still apply. The discipline is to classify the expense, establish its legal treatment, and keep the records that support your conclusion.

    Making eTIMS compliance a habit

    The businesses that cope best with eTIMS rarely scramble at filing time. They have turned invoice checks into a habit that runs alongside the buying itself. They identify which purchases need an electronic invoice and which are excluded. They verify supplier details, buyer PIN and transmission status when the invoice arrives. They reconcile invoices with purchase orders, delivery notes, supplier statements and the ledger. They resolve gaps while the supplier is still easy to reach. And they document everything, including the reason for any exclusion they rely on. A smaller firm can begin with a structured spreadsheet and a monthly review, while a larger one can build the same checks into procurement policy, supplier contracts, payment approvals and system controls.

    Before filing, one last walk-through pays for itself. Does declared income reconcile with sales records and eTIMS data? Are purchases backed by invoices or by a recognised exclusion? Do withholding tax records agree with what was declared? Is import expenditure supported by customs documents? Have cancelled, duplicate and corrected invoices been handled properly? A difference is not proof that an expense is invalid, but it is a reason to look before KRA does.

    Two endings for Achieng

    Suppose the supplier never sends that invoice, and no exclusion applies. The KSh 250,000 expense may be disallowed. At the 30% corporate rate, that is roughly KSh 75,000 of additional tax, before any penalties and interest.

    Now imagine a second version of the story. Achieng’s company has one simple rule: no supplier is paid until a verified eTIMS invoice is on file. The invoice is requested on delivery, checked against its QR code, matched to the purchase order and filed with the payment. When return time arrives, the deduction is already defensible.

    Same equipment. Same money. The only thing that changed was the process.

    The invoice is part of the control system

    An electronic tax invoice looks like a small administrative document. In practice, it links the supplier’s sale to the buyer’s records and feeds the data KRA uses to check returns. It does not make every expense deductible, and a discrepancy does not make every expense disallowed. What has changed is that records must now be reconcilable, verifiable and explainable.

    One transaction. Two sides of the ledger. One invoice that matters to both.

    “Every business transaction has two sides, but its tax consequences do not stop at the ledger: what one business records as a sale, another claims as an expense, and the eTIMS invoice can be the link that holds both records together.”

    eTIMS and tax deductibility: quick answers

    Does an eTIMS invoice make an expense tax deductible?

    No, not by itself. The expense must still be genuine, incurred for business purposes and properly classified. What the eTIMS invoice does is prove the transaction to KRA in the form it expects.

    Do I need eTIMS invoices if I am not VAT-registered?

    Possibly, yes. Electronic invoicing extends to persons carrying on business whether or not they are registered for VAT, and as a buyer you need your suppliers’ invoices to support your own deductions.

    What if my supplier will not issue an eTIMS invoice?

    Ask for a compliant invoice with your correct business name and PIN, verify it, and check whether the purchase falls within an exclusion. For small suppliers with annual turnover not exceeding KSh 5 million, the buyer can raise the invoice through eCitizen, subject to the seller’s approval. Keep the full paper trail either way.

    Which expenses are excluded from the eTIMS invoice requirement?

    The list includes salaries and wages, imports, airline passenger ticketing, interest and fees charged by financial institutions, expenses subject to final withholding tax, and services from non-residents without a permanent establishment in Kenya. An exclusion from invoicing is not the same as a deduction, because the ordinary income tax rules still apply.

    From when must declared expenses be backed by eTIMS invoices?

    KRA allowed a one-off relief for 2025 returns. From the 2026 year of income onwards, declared income and expenses must be supported by valid electronic invoices generated and transmitted through TIMS/eTIMS, subject to the legal exceptions.

    Is your business ready for eTIMS validation?

    If you are unsure whether your invoicing records are complete, how supplier expenses should be treated, or whether your books reconcile with KRA’s data, a structured compliance review can find the gaps and set out practical fixes.

    MN Legal advises businesses on Kenyan tax compliance, legal risk management and the controls that support responsible operations.

    Contact MN Legal to discuss an eTIMS compliance review, invoice and expense reconciliation, or practical tax documentation procedures for your business.

  • When AI Scores the Borrower: Kenya’s New Rules for Automated Lending

    When AI Scores the Borrower: Kenya’s New Rules for Automated Lending

    By Zachary Ongeri | AI & Digital Transformation Associate, MN Legal

    A borrower applies for credit through an app. Within seconds, the application is declined. The message offers little explanation: the applicant did not meet the lender’s requirements.

    Behind that response may be a model evaluating repayment history, income patterns and other customer information. The lender receives a score. The borrower receives a decision that may affect their ability to pay school fees, purchase stock or manage an unexpected expense.

    For lenders using artificial intelligence, that decision carries responsibilities. Can the lender explain the outcome? Can someone review it? Has the system been assessed for discriminatory bias? What happens when the information behind the score is wrong?

    AI lending regulations in Kenya now include specific requirements under regulation 60 of the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026. Covered providers using AI for lending decisions must address explanations, customer disclosures, human oversight, discriminatory bias, model reliability, transparency and data security. The Regulations were gazetted on 29 September 2026. Read Legal Notice No. 191 of 2026.

    For affected businesses, compliance requires a clear connection between the legal requirements and the systems that assess applications, communicate decisions and handle borrower complaints.

    Financial dashboard illustrating AI lending regulations in Kenya
    Illustrative financial dashboard: AI-assisted lending requires oversight and borrower protections.

    Which lenders do Kenya’s AI lending regulations cover?

    The Regulations apply to non-deposit-taking credit business that is not regulated under another written law. They contain express exclusions, including institutions licensed under the Banking Act, alongside other specified categories of financial institutions and credit arrangements.

    A lender must therefore establish whether its business falls within the Regulations before applying regulation 60 to its operations. The provision should not be presented as a rule governing every Kenyan bank or every transaction involving credit.

    The framework also recognises lending models such as buy-now-pay-later, stock-now-pay-later and peer-to-peer lending. Whether a particular business falls within the regime depends on its activities and the applicable exclusions. See regulations 2 and 3.

    This assessment matters for technology teams as much as legal teams. A product described commercially as a payment solution or a software platform may still require careful examination of who provides the credit, who makes the lending decision and which entity bears the regulatory obligations.

    What CBK Regulation 60 requires: 7 duties

    Regulation 60 addresses the use of artificial intelligence for making lending decisions. Its seven requirements can be summarised as follows:

    Requirement What the provision addresses
    Explain automated decisions Customers must receive explanations of automated decisions affecting their loan applications.
    Disclose AI interactions Customers must be informed when they are interacting with an AI system rather than a human agent.
    Retain human oversight Human oversight and review of AI decisions and automated credit decisions must be retained.
    Assess discriminatory bias Risk assessments must identify and mitigate discriminatory bias and unfair outcomes arising from customer data.
    Maintain model reliability Deployed models must be technically robust, accurate and capable of making correct judgments.
    Ensure transparency and accountability AI algorithms, logic, data and design processes must be transparent, accountable and explainable.
    Manage privacy and security Data privacy and security concerns must be adequately managed.

    These duties appear together in regulation 60. Their practical implementation requires cooperation between the people responsible for credit policy, technology, compliance and customer service.

    Explaining an automated loan decision

    A credit score may be useful to a lender while telling the borrower very little.

    Consider an illustrative application declined because the system relied on inaccurate repayment information. A useful explanation should help the borrower understand the material issue and identify whether information needs correcting. The lender should also be able to trace how that information influenced the outcome.

    This requires more than preparing a standard rejection message. Providers should examine whether their systems can generate reasons that accurately reflect the decision and can be understood by the customer.

    The Regulations also contain a general obligation to communicate a declined application immediately and state the reasons for the decision. That requirement under regulation 28 should be considered alongside regulation 60’s explanation requirement when designing customer notices. See regulations 28 and 60.

    The precise detail an explanation should contain will depend on the decision and the applicable legal requirements. As a practical starting point, a lender should be able to identify the significant reasons for the outcome, verify that those reasons match the system’s operation, and direct the borrower to an effective review process.

    Making human review meaningful

    Human oversight works only when the person reviewing the decision can do something useful with it.

    A reviewer needs access to relevant information, an understanding of the system’s limitations and appropriate authority to address an incorrect outcome. A process in which an employee simply repeats the automated result offers limited practical protection.

    Providers should consider documenting:

    • Who is responsible for reviewing challenged decisions.
    • What information the reviewer can access.
    • How customers can submit corrections or additional information.
    • When a decision can be changed or escalated.
    • How the review and its outcome are recorded and communicated.

    These are implementation recommendations. Regulation 60 does not prescribe one review workflow for every lending business.

    The distinction between AI assistance and a fully automated decision also matters. An AI model may inform a credit officer’s assessment, or it may determine the outcome without human involvement. Providers should understand and document what actually happens in their systems, because the applicable data-protection analysis depends partly on that distinction.

    Testing AI credit scoring for bias and accuracy

    A model can produce consistent results while relying on assumptions that deserve closer examination.

    For example, a system might treat irregular income as a strong negative indicator. That approach could affect applicants whose earnings fluctuate because of seasonal work, self-employment or the nature of their businesses.

    A lender should investigate whether the feature is relevant to repayment risk, whether the underlying information is accurate and whether its use produces unfair outcomes. Different outcomes between groups do not, by themselves, establish unlawful discrimination. They can, however, identify issues requiring further assessment.

    Regulation 60 expressly requires risk assessments to identify and mitigate discriminatory bias and unfair outcomes. It also addresses technical robustness and accuracy. See regulation 60(d)–(f).

    A practical governance programme should therefore consider how the model performs before deployment and during use. Relevant evidence may include validation findings, investigations into errors, review of material changes, customer complaints and records of corrective action.

    Providers should also assign responsibility for responding when performance deteriorates. A monitoring report has limited value if nobody is responsible for deciding what happens next.

    AI lending regulations and the Data Protection Act

    The new credit-provider rules sit alongside Kenya’s existing data-protection framework.

    Section 35 of the Data Protection Act addresses decisions based solely on automated processing, including profiling, that produce legal effects or significantly affect an individual. It provides a right not to be subject to such decisions, subject to specified exceptions, including contractual necessity, qualifying legal authorisation and consent.

    The section also requires written notification of relevant solely automated decisions and provides for requests to reconsider a decision or make a new decision that is not based solely on automated processing. Providers must assess the exceptions together with these safeguards. Read section 35 of the Data Protection Act.

    Regulation 22 of the Data Protection (General) Regulations adds requirements concerning meaningful information about the logic involved, the significance and consequences of processing, fairness, error prevention and access to human intervention.

    Regulation 49 identifies certain consequential automated decisions and profiling activities as high-risk processing requiring a data protection impact assessment. A lender should assess its particular use of customer data against those requirements before deployment or relevant changes. Read regulations 22 and 49.

    MN Legal’s guide to DPIA requirements in Kenya explains the assessment process in more detail.

    Using an external AI or credit-scoring provider

    Purchasing a scoring system introduces questions about responsibility, access to information and control over changes.

    Under regulation 31, providers remain liable for the acts and omissions of third-party service providers, and the final decision to grant loans is among the functions excluded from outsourcing. A lender using an external model should therefore examine how the arrangement works in practice and where responsibility for the final decision sits. Read regulation 31.

    The use of a vendor’s scoring tool does not, by itself, resolve whether the arrangement improperly outsources a reserved function. That requires analysis of the actual decision process and contractual arrangements.

    As a practical matter, providers should seek sufficient information and contractual support to investigate errors, understand material changes and respond to customer challenges. Relevant terms may address:

    • Documentation of the system and its intended use.
    • Access to appropriate validation and performance information.
    • Notification of material model changes.
    • Assistance with borrower complaints and reviews.
    • Security incidents, data access and retention.
    • Exit arrangements and access to necessary records.

    The appropriate terms will depend on the service, the information processed and the parties’ respective roles.

    A useful procurement test is to ask the supplier to walk through a sample adverse decision. Can the lender identify the information that mattered, distinguish a data error from a policy choice, and give a reviewer enough context to reconsider the result? The contract should support that practical exercise. A general assurance that a model is accurate will not answer a borrower’s question about a particular application. Legal and technology teams should therefore assess the explanation and review process alongside model performance, rather than leaving those questions until a complaint arrives.

    AI lending regulations: a practical compliance checklist

    A useful starting point is to select an actual lending process and trace it from application to final decision and review.

    The following records can help providers demonstrate how their controls operate. They are suggested implementation evidence, rather than a list of documents expressly prescribed by regulation 60.

    Area Suggested evidence
    Decision process A map showing where AI influences the outcome and where human judgment enters.
    Customer explanations Sample notices linked to the actual reasons used in decisions.
    Human review A review procedure, assigned authority and records of completed reviews.
    Bias and accuracy Assessment findings, validation results and corrective-action records.
    Data protection Data-flow documentation, relevant privacy notices and an applicable DPIA.
    Vendor management Contracts, due-diligence findings and records of material changes.
    Continuing oversight Named owners, monitoring arrangements and escalation procedures.

    The exercise should reveal whether the lender can explain an outcome, correct inaccurate information and respond when a system behaves unexpectedly.

    Frequently asked questions

    Does CBK Regulation 60 apply to banks?

    The Non-Deposit Taking Credit Providers Regulations expressly exclude institutions licensed under the Banking Act. Banks must assess their obligations under the frameworks applicable to them. Regulation 60 should not be described as applying to every Kenyan lender. See regulation 3.

    Must a lender explain an AI-generated loan decision?

    For covered providers using AI for lending decisions, regulation 60 requires explanations of automated decisions affecting loan applications. Regulation 28 separately requires a declined application to be communicated immediately with reasons. See regulations 28 and 60.

    Is automated lending prohibited in Kenya?

    The cited provisions establish duties and safeguards for automated decisions. Section 35 of the Data Protection Act includes exceptions to the right concerning solely automated decisions, while also providing notification and reconsideration safeguards. A provider must assess its specific process against both data-protection requirements and the applicable lending rules. See section 35.

    Does AI credit scoring require a DPIA?

    The answer depends on the processing involved. Regulation 49 identifies certain automated decisions with legal or similarly significant effects, including relevant profiling and algorithmic processing, as high-risk activities requiring a DPIA. Providers should assess their systems against those criteria. See regulation 49.

    For lenders developing or procuring AI systems, the practical objective is to be able to follow an individual application through the entire process: the information collected, the factors influencing the outcome, the explanation delivered and the review available to the borrower. That capability gives legal, credit, technology and customer service teams a shared basis for managing automated lending responsibly.

    Zachary Ongeri is an AI & Digital Transformation Associate at MN Legal, focused on legal technology and frontier regulation. View his profile.

  • The Four Clocks of Hiring Your First Employee in Kenya

    The Four Clocks of Hiring Your First Employee in Kenya

    Payroll compliance in Kenya starts before an employee’s first payday. Hiring your first employee activates four systems at once: filing deadlines, the full cost of employment, the contract and workplace obligations, and the records KRA may review later. For a KES 100,000 gross salary, direct monthly employer cost is KES 107,550 before WIBA insurance, benefits and any additional housing cost. Since the due dates differ, prepare a compliance calendar before payroll begins.

    This guide focuses on payroll timing and cost. For the wider first-hire process, including worker classification and immigration, see MN Legal’s legal compliance guide for hiring in Kenya.

    Payroll compliance in Kenya: an employer and legal advisers review an employment contract
    Set the employment terms before the first payroll.

    Payroll compliance in Kenya: the monthly deadlines

    Kenyan payroll obligations have different deadlines. PAYE, NSSF and SHIF are generally due by the 9th of the following month. The Affordable Housing Levy is due by the 9th working day after the end of the month, as well as NITA. For payroll compliance in Kenya, put each due date, responsible person and proof-of-payment record on its own line in the payroll calendar.

    ObligationEmployer actionPublished deadline
    PAYEFile the monthly return and remit tax withheld from the employeeOn or before the 9th of the following month
    NSSFDeduct the employee contribution and pay the employer matchBy the 9th day of the subsequent month
    SHIFDeduct the employee contribution and remit it through the employer portalBy the 9th day of the subsequent month
    Affordable Housing LevyDeduct the employee share and add the employer shareBy the 9th day of the subsequent month
    NITA industrial training levyPay KES 50 per employee per month; this is an employer cost, not a payroll deductionbefore the 9th of the following month

    These dates come from the Kenya Revenue Authority’s PAYE guidance, the NSSF 2026 employer notice, the Social Health Authority’s employer notice, the KRA’s Affordable Housing Levy notice and NITA’s levy guidance.

    Do not put every payment on one “9th” reminder. Give each obligation its own date, responsible person and proof-of-payment record. Late filing or payment can attract penalties and interest.

    Clock two: the full employer cost

    The agreed gross salary is not the whole monthly cost. From February 2026, NSSF contributions are 6% each for the employee and employer, subject to the current earnings limits. The upper earnings limit is KES 108,000 per month. The employer also contributes 1.5% of gross salary to the Affordable Housing Levy and pays the NITA levy.

    Cost lineAmount (KES)
    Gross salary100,000
    Employer NSSF contribution at 6%6,000
    Employer Affordable Housing Levy at 1.5%1,500
    NITA levy50
    Direct monthly cost before WIBA and benefits107,550

    This example assumes the KES 100,000 package accounts for the employer’s housing obligation, either through accommodation or a salary properly stated to include housing. If it does not, budget for the additional housing cost required under section 31 of the Employment Act. Also budget for mandatory work injury insurance under the Work Injury Benefits Act. The premium depends on the insurer’s assessment and the work being performed.

    PAYE, the employee’s NSSF contribution, SHIF and the employee’s Affordable Housing Levy share are deducted from gross pay and remitted by the employer. They reduce the employee’s take-home pay; they are not additional employer contributions on top of the gross salary. For example, SHIF is 2.75% of gross salary, subject to a KES 300 monthly minimum. Confirm the employee’s net pay with a payroll calculation before issuing an offer.

    For payroll compliance in Kenya, budget for total employment cost, not only the salary figure. Confirm what the contract includes, then price insurance, equipment, medical cover, pension top-ups and any other benefits separately.

    Clock three: the contract and workplace obligations

    Kenyan employment obligations begin when the employee starts work. A contract for service expected to last three months or more must be in writing. Set out the key terms before the start date, even though the Employment Act also requires written particulars within two months of employment beginning.

    • Probation: A probationary period cannot exceed six months. It may be extended for a further period of up to six months with the employee’s agreement.
    • Pay and housing: State the salary, allowances, pay date and whether housing is provided or included in the salary. Check the applicable wage order for the role and location.
    • Termination: Kenyan law sets requirements for notice, reasons and process. Do not assume that a procedure used in another country will satisfy Kenyan law.
    • Workplace rules: Put essential rules on leave, conduct, confidentiality, equipment and remote work in clear written policies. Some policies become expressly mandatory only at specified staff numbers or in particular circumstances. MN Legal explains those thresholds in its guide to workplace policies in Kenya.
    • Employee information: Payroll and personnel files contain personal data. Apply data-protection safeguards and check whether ODPC registration is required. The small-entity exemption depends on meeting both turnover and employee-count thresholds, and some activities are not exempt. See the ODPC registration guidance.

    Use a contract drafted for Kenyan law and keep a signed copy with the employee’s payroll and onboarding records. A foreign template can miss local terms or create uncertainty about housing, probation, leave and termination.

    Clock four: the records and tax-review clock

    KRA can review payroll records after the month in which they were created. Under section 31 of the Tax Procedures Act, an assessment may generally be amended within five years of the relevant self-assessment return. The law allows action at any time in cases involving gross or wilful neglect, evasion or fraud. The five-year period runs from the return date, not simply from the end of the tax year.

    Good payroll compliance in Kenya depends on a complete record. Keep the employment contract, payroll register, payslips, PAYE returns, NSSF and SHIF records, levy filings, bank confirmations and correspondence together. Reconcile what you paid against what you filed each month. KRA’s record-retention guidance explains the general five-year record period.

    Special checks for foreign employers

    Payroll compliance in Kenya for a foreign hire also requires the right immigration permission before work begins. Review the employee’s tax position and payroll treatment based on the facts. If you plan to offer shares or options, obtain tax and employment advice before making the promise; the timing and terms of an incentive can affect its treatment.

    Your first 90 days: an employer checklist

    Before you make the offer

    • Calculate the employer’s total cost, including NSSF, the housing levy, NITA, insurance and any benefits.
    • Confirm the role’s classification, applicable wage requirements and housing arrangement.
    • Set up the relevant KRA PAYE, NSSF, SHA and NITA registrations, and check whether ODPC registration applies.
    • Arrange WIBA cover and prepare a Kenyan-law employment contract.

    Before the first day

    • Sign the contract and give the employee the policies and information they need.
    • Set up payroll using the current statutory rates and deadlines.
    • Confirm work permission for any foreign employee.
    • Set up secure access, storage and retention rules for employee records.

    During the first three months

    • File returns and pay each contribution by its own deadline. Keep the filing confirmation and bank record together.
    • Reconcile the payslip, payroll register, tax return and remittance each month.
    • Calendar the probation end date and make any decision in good time. An extension requires the employee’s agreement and cannot exceed the statutory limit.
    • Check for official rate or earnings-limit changes before the next payroll cycle.

    Five questions to ask before the first hire

    1. What will this employee cost us each month, including employer contributions and insurance?
    2. Which registrations and employer portals must be ready before the first payroll?
    3. What is the due date for each return and payment, and who owns each deadline?
    4. Does the contract clearly state the salary, housing arrangement, probation and notice terms under Kenyan law?
    5. Could we produce the contract, payslip, return and proof of payment if KRA reviews the payroll several years from now?

    A good payroll or legal adviser should be able to answer these questions with a clear calendar and cost breakdown.

    What we would tell you over coffee

    Start with four things written down before the employee begins: the real monthly cost, every filing date, the terms of the Kenyan contract and the records you will keep. Review them every month. Payroll compliance in Kenya is easier to manage when every deadline has an owner and every remittance has a matching record. Most avoidable payroll problems begin when a deadline is discovered after it has passed.

    If you are preparing to hire or want to check your payroll setup, contact MN Legal’s Employment and Labour team or request a confidential consultation.

    This article is for general information only and is not legal or tax advice. Kenyan employment, tax and payroll requirements can change. Obtain advice on your circumstances before making a hiring or payroll decision. Last reviewed: 22 October 2026.

  • Know Your Client: Customer Due Diligence for Kenyan Advocates

    Know Your Client: Customer Due Diligence for Kenyan Advocates

    Most of us went into practice to advise clients, draft agreements and argue matters, not to run compliance checks. Yet over the last few years, anti-money laundering (AML) obligations have become part of the everyday reality of running a law firm in Kenya.

    Customer due diligence for Kenyan advocates means identifying and verifying clients and beneficial owners, understanding the purpose of their instructions, assessing risk, and monitoring the relationship. For work covered by section 48 of the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA), these are practical compliance obligations, not simply an onboarding form.

    Whether you are a sole practitioner in a small town or a partner in a large Nairobi firm, the question is whether your firm understands when these rules apply and is applying them properly.

    This article walks through what customer due diligence (CDD) means for advocates, when it is required, what it involves in practice, and what to do when something about a client or a transaction does not add up.

    Why Kenyan advocates are covered by POCAMLA

    POCAMLA includes advocates, notaries and other independent legal professionals, whether sole practitioners, partners or employees in a firm, within the definition of designated non-financial businesses and professions (DNFBPs).

    Section 48 of POCAMLA is the provision to keep in mind. It applies the obligations in Part IV when an advocate is preparing or carrying out specified transactions for a client, including:

    • buying and selling real estate;
    • managing client money, securities or other assets;
    • managing bank, savings or securities accounts;
    • organising contributions for the creation, operation or management of companies; and
    • creating, operating or managing business entities or legal arrangements, and buying or selling business entities.

    If your practice touches conveyancing, company formation, trusts or holding funds on behalf of clients, you need to assess your instructions against these categories. The scope of the work matters. Reporting obligations also need to be read with the professional-privilege provisions in section 44, discussed below.

    The domestic framework includes the Proceeds of Crime and Anti-Money Laundering Regulations, 2023, alongside other applicable legislation and guidance from the Financial Reporting Centre (FRC) and Law Society of Kenya (LSK).

    So what is customer due diligence?

    Customer due diligence is closely associated with “Know Your Customer” or “Know Your Client”, usually shortened to KYC. In plain terms, it is the set of steps a firm takes to work out who it is really dealing with, why they are instructing the firm, and whether their activity continues to make sense over time.

    It involves identifying the client, verifying their identity, understanding the purpose of the relationship, monitoring what happens along the way, and keeping the information current. Collecting an ID is part of the process. It is not the whole process.

    It is not paperwork for its own sake. It helps protect your firm from being used to launder money or finance terrorism, supports compliance with the law, and protects the reputation you have spent years building.

    When must advocates carry out CDD?

    For business within the applicable AML framework, regulation 14(5) of the 2023 Regulations identifies the occasions that trigger CDD. You should carry it out:

    • when establishing a business relationship with a client;
    • when undertaking an occasional or one-off transaction;
    • when carrying out occasional wire transfers covered by regulation 32;
    • whenever there is cause to suspect money laundering or terrorism financing; and
    • whenever you doubt the accuracy or adequacy of information you collected earlier.

    It applies to new clients, existing clients and occasional clients. For existing relationships, section 45(2) and regulation 14(6) require a materiality-and-risk approach, taking account of earlier checks and the adequacy of the information held. A file opened ten years ago and never revisited is a weak spot.

    Step one: identify and verify the client

    For a natural person, start with an appropriate official identity document, such as a National ID or passport. Section 45(1A)(a) lists acceptable forms of official identification. Regulation 15 sets out further identifying information and additional measures, including a KRA PIN where one has been issued.

    For a company, section 45(1A)(b) and regulation 16 call for information on its legal existence, registered and business addresses, authority to transact, and the people managing, controlling or owning it. Incorporation documents and constitutional documents are part of that picture. Partnerships and trusts have their own requirements under regulations 17 and 18.

    Collecting documents is only half the job. Verification means checking the information against reliable, independent sources. A photocopy handed to you by the client, without any cross-check, is not much of a safeguard. The whole purpose is to avoid a situation where your client is simply a front for someone else who is staying out of sight.

    Record what you checked, the source you used, and any discrepancy that still needs resolving.

    Step two: check people acting on behalf of the client

    In practice, the person sitting across from you is often not the actual client. A director may instruct you on behalf of a company, or an agent may act under a power of attorney.

    Under section 45(3) and regulation 23, you must verify that the person is authorised to act and identify and verify that person’s identity. In practice, you should:

    • obtain documentary proof of authority, such as an appropriate board resolution, power of attorney or other authorisation;
    • verify the representative’s identity; and
    • check that the authority covers the transaction or instructions you are being asked to handle.

    A familiar face or an impressive job title is not a substitute for authority to act.

    Step three: find the beneficial owner

    This is where many files fall short. Regulation 14(2)(b) requires you to identify the beneficial owner and take reasonable measures to verify their identity, so that you are satisfied you know who they are and understand the ownership and control structure.

    A beneficial owner is the natural person who ultimately owns or controls the customer, or on whose behalf a transaction is conducted. The person named on the incorporation documents may not be the person exercising that control.

    For companies, regulation 3(2) of the Companies (Beneficial Ownership Information) Regulations sets out criteria that include:

    • holding at least 10% of the issued shares, directly or indirectly;
    • exercising at least 10% of the voting rights, directly or indirectly;
    • having the right to appoint or remove a majority of the board, directly or indirectly; or
    • exercising significant influence or control, directly or indirectly.

    Do not treat 10% as a universal stopping point for AML enquiries. Ownership is only one route to control, and regulation 16(2) of the AML Regulations addresses control through other means and the relevant senior managing official where no natural person is identified through the preceding tests. Companies limited by guarantee also have specific criteria under regulation 3(2A) of the beneficial-ownership rules.

    If a corporate client’s ownership chain disappears into layers of other companies and you cannot get to a real human being at the end of it, treat that as a finding in itself.

    Step four: risk profile the client

    Not every client carries the same level of risk, and the law does not expect you to treat them all the same. A sensible risk profile looks at:

    • the client’s profile, including their business, legal structure, ownership and source of funds or wealth;
    • the industry or sector they work in;
    • geography;
    • the services they are asking for;
    • how the relationship is delivered, including remotely or through intermediaries; and
    • sanctions, politically exposed person (PEP) status and relevant adverse information.

    The rating you give the client then determines how much work you do next. Record the reasons for the rating, not just a tick beside “low”, “medium” or “high”.

    Enhanced due diligence for higher-risk clients

    Where a client presents higher risk, regulation 20 calls for additional measures:

    • obtaining further information to establish identity;
    • applying extra measures to verify documents supplied;
    • obtaining senior management approval for the new relationship or transaction;
    • establishing the source of funds; and
    • carrying out ongoing monitoring of the relationship.

    Examples of situations that deserve closer attention include opaque ownership, unexplained nominee arrangements, cash-intensive businesses and connections to higher-risk jurisdictions. The applicable response depends on the facts and the relevant legal requirements, including section 45A on higher-risk countries.

    PEPs require particular care. Regulation 26 sets out additional measures for foreign PEPs, including establishing source of wealth and source of funds. For domestic PEPs and people entrusted with prominent functions by international organisations, the additional measures apply where the relationship is higher risk. PEP status is a risk consideration, not a finding of wrongdoing.

    Red flags worth watching for

    Certain patterns should prompt closer attention:

    • Behaviour: the client is secretive about their identity, beneficial ownership or source of funds, or cannot provide suitable identification.
    • Funds: capital is out of proportion to the size or value of the business, or money moves through several foreign accounts without a clear reason.
    • Opaque identities: the instructions involve unexplained third parties, complex corporate structures or a refusal to identify the people behind them.
    • Unusual capital movements: sudden unexplained cash payments, property purchases that do not fit the client’s known circumstances, or requests to park large sums in your client account without substantive legal work.

    The FRC’s guidance notes on suspicious transaction and activity reporting for the legal profession are worth having every fee earner read. A warning sign needs assessment in context; it is not, by itself, proof of a crime.

    Unusual versus suspicious transactions

    One distinction that is often blurred is the difference between an unusual transaction and a suspicious one.

    An unusual transaction departs from the profile you built at onboarding. That alone does not automatically establish suspicion. It is a prompt to ask questions, collect appropriate information and assess whether there are grounds to suspect a link to money laundering, terrorism financing, proliferation financing or proceeds of crime.

    Useful questions include: Where is the money coming from, and where is it going? Is there pressure to hurry beyond what is normal? Does the transaction fit the client’s stated business or financial standing?

    Once suspicion arises, further enquiries must not be used to postpone a reporting duty. Section 44(2) requires a report in the specified manner within two days after suspicion arises, and section 44(3) includes attempted suspicious transactions.

    Reporting, professional privilege and tipping off

    The reporting duty must be read with sections 44(3A) and 44(3B). These protect information obtained in the specified circumstances of professional secrecy or legal professional privilege, including ascertaining a client’s legal position and defending or representing the client in the listed proceedings. This is not a blanket exemption for everything on a lawyer’s file.

    Section 44(3) permits lawyers to submit reports through the LSK, which is to establish reporting channels to the FRC. Follow the applicable FRC and LSK reporting procedures and assess privilege carefully. Section 8 also addresses tipping off: do not disclose that a suspicious report is being prepared or has been made in circumstances prohibited by the Act.

    What if you cannot complete identity checks?

    Missing identification is not something to leave unresolved indefinitely. Regulation 25(2) sets out restrictions on starting or continuing the relationship or transaction where the applicant does not supply identity evidence as soon as reasonably practicable, together with an STR requirement. Apply these provisions alongside the Act’s privilege protections.

    Regulation 25(6) also addresses the situation where pursuing CDD would risk tipping off a client: where its conditions are met, the reporting institution may stop pursuing that process and must instead file an STR. Escalate these situations promptly through your firm’s compliance arrangements.

    CDD does not end at onboarding

    Ongoing due diligence means keeping an eye on the client’s activity and making sure it stays consistent with what you know about their business, risk profile and source of funds. It also means refreshing documents and data so your records do not go stale.

    How often you review depends on risk. Higher-risk clients need closer attention. Reviews can be periodic, or triggered by an event such as:

    • a change in the client’s identity or beneficial ownership;
    • a change in the services you provide;
    • suspicion of money laundering, terrorism financing or proliferation financing;
    • a significant change in key office holders;
    • PEP involvement; or
    • changes in legislation.

    A real-world lesson: the Windward Trading case

    In February 2016, Windward Trading Limited pleaded guilty to four counts of money laundering before the Royal Court of Jersey. The Government of Jersey’s account identifies its beneficial owner as Samuel Gichuru, then Chief Executive of Kenya Power and Lighting Company during the relevant period, and describes corrupt payments made to Windward by companies awarded KPLC contracts.

    For advocates, the lesson is practical. The name of a company is only the beginning of the enquiry. Who controls it, where its money comes from, and whether those funds fit the person’s known role can matter far more than the appearance of an ordinary corporate vehicle.

    A practical CDD checklist for your firm

    If you have not reviewed your firm’s AML arrangements recently, a good starting point is to check that you have:

    • a written policy and procedure covering CDD, enhanced due diligence, reporting and record keeping;
    • an internal risk assessment for your practice areas;
    • a designated person responsible for AML compliance and reporting;
    • an onboarding checklist covering identity, authority to act, beneficial ownership, the purpose of the instructions, and source-of-funds enquiries appropriate to risk;
    • a record of checks completed and reasons for the client’s risk rating;
    • regular training for lawyers and support staff;
    • a process for periodic and event-driven reviews of existing clients; and
    • a clear retention and retrieval process for compliance records.

    Section 46(4) requires relevant records to be kept for at least seven years from completion of the relevant business or transaction, or termination of the account or relationship, as applicable. The FRC may require a longer period, and other legal retention obligations remain relevant.

    Common questions about CDD for Kenyan advocates

    Is collecting a client’s ID enough?

    No. CDD also covers verification, beneficial ownership, the purpose of the relationship and ongoing monitoring. A copy of an ID does not answer all those questions.

    Do you need to review existing clients?

    Yes. The Act and Regulations require CDD on existing relationships according to materiality and risk, taking earlier checks and the adequacy of the information into account.

    Does every unusual transaction require an STR?

    Unusual activity requires assessment. A suspicion-based reporting obligation arises when the relevant threshold is met, subject to the statutory privilege provisions. Separate duties, including regulation 25 where identity evidence is not supplied, must also be considered.

    Making CDD work in your practice

    CDD can feel like an extra burden on top of an already busy practice. But it is increasingly part of professional competence, and the cost of getting it wrong, in penalties, reputation and potential involvement in a criminal matter, can be far higher than the cost of doing it well.

    A few good questions at the start of a relationship, and the discipline to keep asking them, go a long way.

    MN Legal provides AML and CDD advisory in Kenya. If your firm needs advice on its obligations or has questions about its current arrangements, speak to MN Legal about AML/CDD compliance. Let us know whether your enquiry concerns onboarding, beneficial ownership, higher-risk clients or your firm’s wider compliance arrangements.

    Email: info@mnlegal.net · Telephone: +254 700 325 089

    About the author: Husna (A.) Mohammed is a Senior Associate at MN Legal and an Advocate of the High Court of Kenya. Her practice focuses on corporate commercial and real estate law.

    This article is intended for general information only and does not constitute legal advice. Please refer to the current text of POCAMLA, the applicable Regulations and FRC/LSK guidance, or speak to us directly for advice on your specific situation.

  • AI Transformation in Law Firms: The 2026 Strategic Playbook

    AI Transformation in Law Firms: The 2026 Strategic Playbook

    Navigating AI transformation, agentic infrastructure, and practice innovation in modern law firms.

    Executive Summary for Law Firm Leadership: True AI transformation in law firms is not a software rollout; it is an overhaul of the firm’s operating engine. While 85% of firms remain trapped in “pilot purgatory” paying for individual chatbot licenses, market leaders treat artificial intelligence as production infrastructure. Real transformation requires three structural pivots: replacing manual associate tasks with agentic workflows connected directly to your document management system (DMS); abandoning the self-defeating billable hour in favor of value-based pricing that captures the “tech dividend”; and transforming decades of archived work product into a proprietary data moat that compounds institutional intelligence over time. Our corporate governance and advisory practice regularly guides legal and enterprise leaders through this operational evolution.

    The $650-an-Hour Paradox: When 15 Hours Compresses to 12 Minutes

    In late 2025, a premier corporate law firm was retained by a multinational private equity client to handle commercial contract diligence for a $140 million cross-border acquisition.

    Following traditional firm workflow, a senior partner assigned two mid-level associates to review a virtual data room containing 280 commercial supply agreements, intellectual property assignments, and cross-guarantee instruments. Working across a weekend, the associates logged 72 billable hours at $650 per hour to analyze change-of-control triggers, uncapped liability clauses, and assignment covenants. The resulting line item on the interim billing statement totaled $46,800.

    On Tuesday morning, the client’s General Counsel summoned the relationship partner to an immediate videoconference.

    The General Counsel had not disputed the accuracy of the review. Instead, she shared her screen. Her internal legal operations team had run the same data room through an enterprise-governed agentic pipeline anchored by specialized legal configurations of Claude and Harvey. In exactly 12 minutes and 40 seconds, the system had extracted every non-standard indemnification clause, cross-referenced the change-of-control thresholds against the company’s negotiation playbook, flagged six undisclosed liabilities, and produced an auditable redline with pinpoint page citations. The compute cost: $14.20.

    The General Counsel struck the $46,800 charge from the invoice with a single directive:

    “We hire your firm for your partners’ judgment, regulatory leverage, and tactical deal structuring. We will never again pay for junior associates to manually read contracts that software can parse before our morning coffee.”

    This encounter illustrates the defining crisis of modern legal practice. According to research from the Harvard Law School Center on the Legal Profession, corporate legal departments are aggressively adopting generative tools to insource routine analysis and audit outside legal spending. The traditional law firm business model was constructed on monetizing associate time. Generative AI destroys the commercial logic of that time.

    Firms that simply purchase AI licenses while preserving the billable hour are participating in an economic race to the bottom: the faster and more efficient their lawyers become, the less revenue the firm collects. To survive and expand margins, partnerships must understand what AI transformation in law firms actually entails.

    The Operational Diagnostic: Escaping Law Firm “Pilot Purgatory”

    In evaluating legal practice operations across the market, our advisory team observes a recurring structural failure: law firms consistently confuse individual employee assistance with institutional production infrastructure.

    Most law firms are currently stalled in what we diagnose as “Pilot Purgatory.” A firm purchases 500 enterprise seats of an AI copilot, issues a cautious acceptable-use memo, and conducts an optional lunch-and-learn. Individual associates use the tool to draft emails, summarize deposition transcripts, or brainstorm discovery interrogatories.

    While individual lawyers may save 30 minutes a day, the firm itself has transformed nothing. When that associate logs off, the interaction vanishes. The firm’s operating margins remain unchanged, and its competitive positioning against peer firms remains identical.

    Level 1: Ad-Hoc Adoption (The Toy Phase)Level 2: Production Infrastructure (True Transformation)
    Individual chatbot windows and ad-hoc promptsAutonomous, multi-step agentic pipelines
    Ephemeral, stateless chat sessionsPersistent institutional memory and knowledge graphs
    Manual copy-pasting between browser and WordNative DMS (iManage, NetDocuments) integration
    Billed by the hour (destroying margin)Value-based, fixed-fee alternative fee arrangements
    Black-box outputs without verificationInspectable surfaces and source-grounded citations

    To move from cosmetic adoption to genuine transformation, law firm leadership must implement four foundational architecture principles across their practice groups:

    1. From “Assistants” to “Production Infrastructure”: An assistant waits for a human prompt. Production infrastructure executes business logic automatically. In a transformed firm, AI is not an isolated browser tab; it is an active engine integrated directly into the matter intake pipeline. When a new lawsuit is filed or an NDA arrives via email, the system automatically parses jurisdiction, checks conflict databases, executes initial risk triage, and populates the matter file in your document management system before a human attorney even opens the folder.
    2. Accumulating Institutional Intelligence: Foundation large language models are stateless: they know what the public internet knows, but they know nothing about how your firm negotiates. True enterprise advantage comes from systematically accumulating institutional intelligence. Every settlement reached, every fallback clause drafted by your senior corporate partners, and every judge-specific procedural strategy must be structured and indexed. A transformed firm does not prompt a generic model; it prompts a model grounded in twenty years of its own hard-won precedents.
    3. Inspectable Surfaces and Auditable Workflows: In a courtroom or a high-stakes M&A negotiation, an unverified AI generation is legal malpractice. Black-box outputs are inadmissible in elite practice. Transformation requires inspectable surfaces: user interfaces where the model’s underlying chain of reasoning, statutory citations, and contract clause coordinates are displayed side-by-side with the output. The lawyer acts as an auditor and guarantor of accuracy, verifying traceable links back to primary source materials before client submission.
    4. The Meta-Competency of Legal Orchestration: As generative models compress the time required for research, drafting, and document analysis from days to minutes, professional roles converge. The defining skill of the modern lawyer is orchestration: the ability to decompose a complex commercial objective into discrete agentic tasks, evaluate outputs critically, and synthesize high-level legal strategy. Law firms must stop training associates to be document scriveners and begin training them as legal system orchestrators.

    The 2026 Tech Landscape: Claude vs. OpenAI vs. Google AI in Legal

    The legal technology market underwent a decisive shift in 2026. The major AI research labs moved beyond general enterprise software to release specialized, legally governed platforms designed to integrate directly with firm infrastructure.

    Architectural DimensionAnthropic: Claude for LegalOpenAI: Astra for Law & HarveyGoogle: Gemini Enterprise for Legal
    Primary Technical AdvantageModel Context Protocol (MCP) connectors linking directly to iManage, NetDocuments, Relativity, and Microsoft 365.Agentic Workflow Engine and multi-agent reasoning vaults developed in close partnership with legal platforms like Harvey.Google Cloud Vertex AI infrastructure with 2M+ Token Context Window for full-corpus discovery and entire M&A data room ingestion.
    Tone & Drafting PrecisionNuanced, precise, and naturally calibrated legal prose; exceptional adherence to strict negative drafting constraints.Highly structured, decisive logic; exceptional at rapid cross-disciplinary synthesis and multi-jurisdictional statutory mapping.Native integration with Google Workspace (Docs, Sheets) with direct grounding against verified precedent databases.
    Notable DeploymentsQuinn Emanuel, Freshfields, Holland & Knight; foundational engine behind Robin AI.Global firm-wide deployment at A&O Shearman (3,500+ lawyers across 43 offices); OpenAI Enterprise at Willkie Farr.Cleary Gottlieb, Freshfields, Weil, Gotshal & Manges, Williams & Connolly.
    Ideal Law Firm WorkloadsComplex contract negotiation, regulatory comment letters, appellate brief drafting.Multi-tier transactional diligence, automated deal closing checklists, structured discovery interrogatories.Massive multi-volume e-discovery litigation, full virtual data room lease analysis, antitrust merger filings.
    Privilege & Data IsolationZero-retention enterprise SLAs; customer data strictly excluded from model retraining; SOC 2 Type II certified.Dedicated enterprise instances with contractual zero-training clauses and comprehensive compliance logging.Vertex AI private tenancy; Customer-Managed Encryption Keys (CMEK); guaranteed tenant isolation and ethical walls.

    Choosing an underlying model is no longer about raw benchmark scores. It is about architectural interoperability: how cleanly does the model connect to your existing matter management software, how strictly does it honor ethical walls, and how effectively can it be grounded in your firm’s historical work product?

    The 5 Pillars of Real Law Firm AI Transformation

    Pillar 1: Workflow Architecture: From Prompting to Agentic Automation

    The first pillar of transformation requires dismantling the misconception that lawyers should spend their day typing prompts into a text box. Ad-hoc prompting is human-dependent, unstandardized, and prone to user error.

    Transformed law firms build deterministic agentic pipelines. In our commercial contract drafting practice, we implement structured pipelines where an incoming contract is automatically parsed by an intake agent into discrete operative sections, evaluated against established fallback clauses, and redlined directly in Microsoft Word with Track Changes enabled. The supervising attorney reviews an executive risk summary and the redlined document side-by-side, verifying changes in minutes rather than drafting boilerplate from scratch.

    Pillar 2: The Economic Engine: Capturing the “Tech Dividend”

    For over a century, the economic engine of commercial law has rested on the billable hour. Time-based billing created an unfortunate structural alignment: firm revenues expanded as efficiency decreased. Generative AI breaks this economic relationship. As detailed by analysis from the Thomson Reuters Institute, if an automated diligence engine compresses a 20-hour contract review into 20 minutes, an hourly billing model slashes firm revenue by 98%.

    Market leaders recognize that AI transformation requires a complete restructuring of their billing model to capture the Tech Dividend, representing the economic spread between the value delivered to the client and the near-zero marginal cost of computational execution.

    • Traditional Hourly Billing: 20 Associate Hours @ $600/hr = $12,000 Client Cost. Firm Profit Margin: ~40% = $4,800.
    • Untransformed Firm Using AI (Hourly Pricing): 0.5 Associate Hours @ $600/hr = $300 Client Cost + $20 Software = $320 Billed. Partner Profit: $128 (a 97.3% revenue collapse).
    • Transformed Firm (Value-Based Fixed Pricing): Agreed Fixed Fee for Expedited Diligence: $6,500 (Client saves $5,500 vs. market rate). Cost of Delivery: 0.5 Associate Hours ($150) + AI Compute ($20) = $170. Firm Profit Margin: ~97% = $6,330 Partner Profit (+31.8% increase in absolute profit).

    By transitioning to Alternative Fee Arrangements (AFAs), such as fixed-fee diligence packages, monthly advisory retainers under our corporate governance frameworks, and outcome-indexed fees, the firm decouples revenue from time. The client receives faster turnaround times and budget certainty; the firm increases its margins by monetizing technological efficiency rather than human fatigue.

    Pillar 3: Talent Architecture: From the “Pyramid” to the “Obelisk”

    Since the early 1900s, commercial firms have utilized the traditional leverage model: a wide base of junior associates billed at high hourly rates to generate surplus profits for a small tier of equity partners. AI fundamentally narrows the base of that pyramid. When junior associates are no longer needed to spend 80 hours a week reading PDFs in windowless conference rooms, the traditional staffing ratio collapses into what industry analysts call the “Obelisk” or the “Diamond.”

    This structural shift introduces a profound organizational dilemma: The Junior Training Paradox. If an AI agent performs all initial drafting and diligence, how do first-year lawyers develop the professional intuition and legal judgment required to advise clients a decade later?

    Leading firms are solving this challenge through overhauled talent development and retention frameworks: transitioning associates from scriveners to auditors from Day 1, running simulated practice labs through internal LLM environments to compress years of negotiation pattern recognition into structured modules, and immersing junior associates directly into client strategy sessions.

    Pillar 4: The Proprietary Data Moat

    Every law firm has access to the same commercial AI models. A subscription to Claude, OpenAI, or Gemini does not confer a defensible competitive advantage. The only sustainable differentiator for a law firm in the AI era is its proprietary data asset.

    Most law firms sit on an unmined gold reserve: millions of documents stored across iManage or NetDocuments representing decades of legal ingenuity. Transformed law firms clean, tag, and sanitize their historical work product, stripping client identifiers while preserving legal logic, negotiation histories, and drafting notes. They build custom retrieval-augmented generation (RAG) graphs. When a partner prepares a dispute strategy, our commercial dispute resolution practice utilizes agents grounded in our own settled matters, judicial precedent databases, and procedural filings to construct pleadings tailored to specific court jurisdictions.

    Pillar 5: Privilege, Risk & Client Outside Counsel Guidelines (OCGs)

    Lawyers operate under strict ethical canons: the ABA Model Rule 1.1 (Duty of Competence), which requires lawyers to keep abreast of the benefits and risks associated with relevant technology, and the ABA Model Rule 1.6 (Duty of Confidentiality). In 2026, two legal developments heightened the stakes for law firm AI governance:

    First, landmark federal jurisprudence in United States v. Heppner (2026) established that while entering privileged client facts into properly governed, zero-retention enterprise systems does not automatically waive privilege, inputting confidential client data into consumer-grade or unvetted cloud tools that retain data for training constitutes a reckless disclosure, resulting in a complete waiver of the attorney-client privilege.

    Second, Fortune 500 GCs routinely update their Outside Counsel Guidelines with stringent AI provisions: mandatory prohibitions on unvetted consumer tools, auditability mandates requiring outside counsel to certify prompt chains, and explicit prohibitions against billing hourly rates for automatable tasks. Establishing proactive statutory regulatory compliance audits is essential for firms to maintain institutional trust.

    The 5-Phase AI Transformation Roadmap for Managing Partners

    1. Phase 1: Governance & Security Audit (Days 1 to 60): Block consumer AI tools across all firm networks and endpoints. Deploy enterprise-grade foundational environments with zero-data-retention guarantees. Audit client Outside Counsel Guidelines (OCGs) for AI compliance obligations.
    2. Phase 2: High-Volume Workflow Discovery (Days 61 to 120): Map high-frequency, repetitive associate tasks across your top practice groups. Identify beachhead workflows: NDA triage, lease abstraction, litigation timelines. Benchmark current baseline costs, turnaround times, and realization rates.
    3. Phase 3: Agentic Infrastructure Deployment (Days 121 to 240): Connect foundational models to your DMS via secure API connectors. Build inspectable, redlining agent pipelines with human-in-the-loop audit gates. Mandate firm-wide certification programs on legal orchestration and output auditing.
    4. Phase 4: Business Model & Billing Realignment (Days 241 to 360): Introduce fixed-fee and value-based pricing for automated workflow deliverables. Adjust associate performance metrics to reward efficiency, innovation, and client value. Package proprietary automated review workflows into client-facing advisory products.
    5. Phase 5: Proprietary Knowledge Asset Capitalization (Year 2 and Beyond): Clean, structure, and vectorize the firm’s decades of historical precedent documents. Deploy proprietary practice-specific models grounded exclusively in firm IP. Establish a permanent technology innovation dividend in partner compensation metrics.

    Frequently Asked Questions

    What is the difference between AI adoption and AI transformation in a law firm?

    AI adoption is tactical and tool-centric: buying licenses for an AI assistant and letting lawyers use it voluntarily for individual drafting or summarization. AI transformation is strategic and systemic: re-architecting the firm’s core workflows into automated agentic pipelines, realigning pricing away from the billable hour toward value-based fees, revamping junior talent development, and structuring the firm’s precedent repository into a proprietary data moat.

    Will AI eliminate junior lawyers at law firms?

    No, but it will fundamentally change what junior lawyers do. The demand for associates who spend thousands of hours manually proofreading, cross-referencing citations, or summarizing contracts will decline precipitously. However, firms will actively compete for junior lawyers who excel at orchestration: lawyers who can operate multi-agent systems, critically audit AI-generated legal reasoning, spot commercial risk, and communicate complex strategy directly to clients early in their careers.

    How do law firms maintain attorney-client privilege when using generative AI?

    Firms must utilize enterprise-grade deployments with strict contractual guarantees that customer inputs are neither retained nor used to train foundation models. According to emerging 2026 case law (such as United States v. Heppner), feeding confidential client data into public, consumer-grade models constitutes a reckless waiver of privilege. Enterprise systems deploying dedicated virtual private clouds, customer-managed encryption keys, and zero-retention policies protect work product and maintain the attorney-client privilege.

    How can a law firm transition away from the billable hour without losing revenue?

    By capturing the Tech Dividend. When a task that previously took 15 hours is executed in 15 minutes by an AI agent, billing by the hour destroys firm revenue. However, if the firm packages that deliverable as a fixed-fee service at a modest discount to historical rates, the client enjoys budget predictability and rapid delivery, while the firm achieves profit margins exceeding 90% on that workflow due to negligible marginal compute costs.

    Final Directive: The Cost of Inaction

    Law firm partnerships are inherently conservative institutions. For decades, legal leaders could comfortably wait for new technologies to mature before adopting them. Generative AI offers no such grace period. Because generative models learn and compound institutional intelligence over time, the competitive gap between firms operating automated agentic infrastructure and those relying on manual associate billable hours is widening exponentially.

    Clients will not subsidize human inefficiency when software delivers higher precision in minutes. The firms that thrive over the next decade will not be those that boast the most lavish office leases or the largest associate pools. They will be the firms that view artificial intelligence not as a tool to automate yesterday’s tasks, but as the foundational architecture upon which tomorrow’s legal enterprise is built.

    For strategic counsel on legal technology governance, corporate policy structuring, and compliance frameworks, contact our practice leaders at MN LAdvocates LLP or schedule an executive consultation. Explore more analysis in our legal innovation insights hub.

  • Workplace Policies in Kenya: Why Contracts Alone Won’t Protect Your Business

    Workplace Policies in Kenya: Why Contracts Alone Won’t Protect Your Business

    workplace policies in Kenya compliance guide

    Quick Summary for Employers: Establishing clear workplace policies in Kenya is the single most effective way to protect your business against catastrophic legal liability. Under the Employment Act, 2007 (Cap 226) and binding decisions of the Employment and Labour Relations Court (ELRC), dismissals fail when organisations lack documented, consistently enforced workplace rules. Without written disciplinary procedures, sexual harassment policies, or data governance frameworks, even justified terminations are routinely ruled procedurally unfair, exposing employers to compensation awards of up to 12 months’ gross salary per employee. Our employment and labour law practice regularly advises companies on closing these governance gaps.

    The Ksh 4.2 Million Oversight: What Happens Without Workplace Policies in Kenya

    In 2021, an expanding logistics firm based along Mombasa Road in Nairobi dismissed an operations supervisor. The employee had arrived over an hour late on four consecutive Mondays, leaving fleet drivers idle and delaying client deliveries across the country.

    The Managing Director called him into the boardroom, pointed out the clear operational disruption, issued a termination letter citing gross insubordination, and paid him one month’s salary in lieu of notice alongside his accrued leave days.

    To the Managing Director, the decision seemed practical, fair, and commercially obvious.

    Six months later, the company stood before the Employment and Labour Relations Court (ELRC). The dismissed supervisor did not deny the lateness. Instead, his advocate raised three simple questions:

    1. Where is the company’s written attendance policy defining persistent lateness as gross misconduct warranting summary dismissal?
    2. Where is the record demonstrating the employee received, read, and signed an acknowledgement for that policy?
    3. Where is the written notice under Section 41 of the Employment Act inviting the employee to a hearing in the presence of a colleague of his choice before the decision was made?

    The company had none of these. There was an individual employment contract, but no formal workplace policies in Kenya to govern workplace conduct. According to official judicial interpretations documented in Kenya Law Reports, the court ruled the termination substantively and procedurally unfair. The award: eight months’ gross pay in compensatory damages, unpaid overtime calculations, and legal costs totaling just over Ksh 4.2 million.

    This was not a rogue employer acting in bad faith. It was a well-intentioned leadership team that failed to realize an employment contract cannot substitute for institutional workplace policies in Kenya.

    Contracts vs. Workplace Policies in Kenya: Understanding the Difference

    Every business operating locally begins by drafting standard employment contracts. These agreements define core deliverables, set probation periods, agree on remuneration, and specify statutory tax deductions.

    However, an employment contract is an individual agreement between one employee and the firm. It answers: “What does this specific person do, and what are they paid?”

    In contrast, effective workplace policies in Kenya govern the entire institution. They form the core of your corporate governance framework by providing standardized answers to critical operational dilemmas:

    • How does the company investigate an allegation of sexual harassment between a senior director and an intern?
    • What exact steps must a manager take before dismissing an underperforming sales executive?
    • May an employee download proprietary customer databases to a personal laptop while working remotely?
    • What occurs when an employee exhausts statutory sick leave during long-term medical recovery?
    • What constitutes an unlawful conflict of interest when an employee operates an outside side-hustle?

    When an organisation operates without documented rules, decisions are made arbitrarily by individual managers. Inconsistency is the primary trigger for employment litigation. If one supervisor overlooks unpunctuality while another terminates an employee for the same offence, the company faces exposure under Article 41 of the Constitution of Kenya (Fair Labour Practices) and Section 5 of the Employment Act.

    Employment Contract (Individual)Workplace Policies in Kenya (Institutional)
    Job title and direct reporting lineSection 41 fair hearing steps & notice timelines
    Agreed basic salary, allowances & pay datesObjective performance improvement plans (PIP)
    Probation length and workplace locationEmployee data privacy & device usage (DPA 2019)
    Statutory annual leave baseline (21 days)Sexual harassment reporting & non-retaliation rules
    Contract termination notice periodRemote work, confidentiality & intellectual property

    Why Workplace Policies in Kenya Are a Statutory Requirement

    Kenyan labour legislation does not treat human resource policies as optional administrative suggestions. In several critical areas, Parliament has made written policies an express statutory duty:

    1. Section 41 Disciplinary Hearing Rules

    Under Section 41 of the Employment Act, an employer must explain the reasons for an intended dismissal in a language the employee understands, grant an opportunity to respond, and permit a colleague or union representative to attend the hearing. Without documented workplace policies in Kenya, an employer cannot prove that a fair, uniform procedure was applied. Our team frequently provides commercial dispute resolution representation when procedural compliance is contested.

    2. Mandatory Sexual Harassment Policy (20+ Staff)

    Under Section 6(2) of the Employment Act, 2007, every enterprise employing 20 or more staff is legally mandated to implement and display a written policy statement against sexual harassment. The policy must define prohibited conduct, establish a secure grievance channel, and protect whistleblowers from retaliation.

    3. Occupational Safety & Health Act (OSHA 2007)

    Under Section 6 of OSHA, enforced by the Ministry of Labour and Social Protection (DOSHS), businesses with 20 or more workers must prepare and regularly revise a written statement of health and safety policy. Failure to maintain compliant safety standards exposes directors to statutory fines and civil liability.

    4. Data Protection Act Compliance

    Employee biometrics, CCTV surveillance recordings, payroll numbers, and emergency contact details are classified as personal data. Under guidelines issued by the Office of the Data Protection Commissioner (ODPC), employers must establish an Employee Privacy Notice and internal data management rules to avoid regulatory penalties of up to Ksh 5 million.

    Substantive vs. Procedural Fairness in Kenyan Employment Disputes

    The single most dangerous misconception among business owners is believing that a valid reason to dismiss an employee guarantees safety from lawsuits. Under Sections 43 and 45 of the Employment Act, Kenyan courts enforce a strict two-pronged test on every termination:

    Substantive Fairness (The “Why”)Procedural Fairness (The “How”)
    Did gross misconduct or theft actually happen?Was a formal written show-cause letter issued?
    Is poor performance objectively measured?Did the worker receive at least 48 hours to prepare?
    Is there a genuine operational redundancy?Were they invited to bring a colleague or union rep?
    Is there credible evidence on record?Was an impartial hearing held before deciding?

    If an employer proves theft occurred (substantive justification) but dismissed the worker without a written show-cause letter or hearing (procedural failure), the court will deem the termination unlawful. Under Section 49, the ELRC can award up to 12 months’ gross salary in damages, plus notice pay, accrued leave, and legal costs. Conducting regular statutory regulatory compliance audits is the most reliable method to eliminate this risk.

    5 Costly Mistakes Employers Make with Workplace Policies in Kenya

    In our advisory practice at MNL Advocates LLP, we frequently identify five recurring compliance mistakes across growing businesses:

    MistakeOperational RealityLegal Exposure
    1. The Foreign TemplateCopying a staff handbook from a UK, US, or South African branch without local adaptation.Confers unwanted obligations or breaches mandatory Kenyan statutory minimums.
    2. The Unacknowledged PolicyStoring rules on an intranet or HR drive without signed acknowledgement forms.Employees claim in court they never received the rule; uncommunicated policies cannot be enforced.
    3. Bypassing Process for ‘Obvious’ CasesTerminating on the spot because an offence was caught on camera.Violates Section 41, causing employers to lose cases on procedural grounds despite clear guilt.
    4. Forfeiting Statutory RightsAttempting to draft clauses that forfeit statutory annual leave or reduce notice pay.Section 3 renders any term falling below statutory minimums null and void.
    5. Outdated HandbooksUsing handbooks that do not reflect recent labour amendments.Leaves companies non-compliant with SHIF deductions, Housing Levy requirements, and remote work privacy.

    What Comprehensive Workplace Policies in Kenya Must Contain

    A robust organisational handbook tailored to Kenyan law should address twelve key chapters:

    1. Recruitment & Fair Hiring: Objective screening criteria, statutory background checks, and clear probation terms.
    2. Working Hours & Overtime: Standard statutory work week limitations, shift schedules, overtime compensation, and flexible working arrangements.
    3. Remuneration & Deductions: Regular pay cycles, statutory remittances (PAYE, NSSF, SHIF, Housing Levy), and strict limits on unlawful salary deductions.
    4. Statutory Leave Entitlements: Annual leave (minimum 21 working days), maternity leave (3 months fully paid), paternity leave (2 weeks), and sick leave rules.
    5. Anti-Harassment & Equal Opportunity: Strict sexual harassment definitions, anonymous reporting pathways, and anti-retaliation provisions.
    6. Health, Safety & Environment: Incident reporting protocols, fire safety, and compliance with OSHA 2007.
    7. Data Protection & Electronic Devices: Company email usage, device security (BYOD), CCTV monitoring, and privacy protections under the Data Protection Act, 2019.
    8. Code of Conduct & Ethics: Anti-bribery compliance, conflict of interest disclosures, and non-disclosure standards.
    9. Disciplinary Protocol: Classification of offences, show-cause procedures, and a standardized Section 41 hearing workflow.
    10. Internal Grievance Redressal: Clear escalation channels to resolve employee disputes internally before external mediation or litigation.
    11. Separation & Offboarding: Resignation procedures, redundancy protocols, handover checklists, and statutory certificates of service under Section 51.
    12. Policy Review Framework: A defined mechanism for annual reviews to adapt to statutory changes.

    For organisations looking to standardize these chapters, our team specializes in bespoke employee handbook drafting tailored to your industry’s exact risk profile.

    5-Minute Employer Compliance Checklist

    Assess your current human resource framework against these seven critical benchmarks:

    • Staff Sign-Off: Do you hold signed acknowledgement forms confirming 100% of employees have received the current staff handbook?
    • Disciplinary Alignment: Does your policy mandate a written show-cause notice, a 48-hour preparation window, and the right to a companion before termination?
    • Harassment Policy: If employing 20 or more workers, is your written sexual harassment policy visibly posted in the workplace?
    • Data Protection Notice: Has your organisation issued an Employee Privacy Notice detailing the processing of employee personal and biometric data?
    • Leave Floor Compliance: Does your leave policy guarantee the minimum 21 working days of annual leave without illegal forfeiture terms?
    • Authorized Deductions: Are payroll deductions strictly confined to statutory deductions and employee-authorized written deductions?
    • Regular Updates: Has your legal policy framework been formally audited and updated within the past 24 months?

    If you answered “No” to any of these questions, your company is exposed to avoidable risk before the Employment and Labour Relations Court.

    Frequently Asked Questions

    Is an employee handbook legally mandatory in Kenya?

    While the Employment Act does not explicitly use the term “handbook,” having written workplace policies in Kenya is practically mandatory. Key policies including a sexual harassment policy (mandatory for 20+ staff under Section 6(2)) and a health and safety policy under OSHA are direct statutory obligations. Courts also require written company policies to assess whether disciplinary actions were applied consistently.

    Can an employer fire an employee on the spot for gross misconduct?

    No. Under Kenyan law, even in cases of gross misconduct permitting summary dismissal under Section 44, employers must comply with Section 41. You must state the accusations, grant time to prepare, conduct a hearing, and allow a colleague or union representative to attend before reaching a termination decision.

    Can company policies offer less leave than the Employment Act?

    No. Section 3 of the Employment Act establishes statutory benefits as an absolute floor. Any contract or policy providing fewer than 21 working days of annual leave, 3 months of maternity leave, or 2 weeks of paternity leave is null and void.

    What compensation can the court award for unfair termination in Kenya?

    Under Section 49 of the Employment Act, the Employment and Labour Relations Court can award up to 12 months’ gross salary in compensatory damages, alongside terminal dues, pay in lieu of notice, accrued leave, and party-and-party legal costs.

    Protect Your Business with Compliant Workplace Policies in Kenya

    A well-drafted policy manual is the single most effective risk management tool available to Kenyan employers. It establishes clear expectations, prevents erratic managerial decisions, and provides an ironclad defence if an employee raises a tribunal challenge.

    The employment practice at MNL Advocates LLP assists employers, startups, and foreign investors across Kenya to conduct HR compliance audits, draft customized workplace policies in Kenya, and guide management through complex disciplinary procedures. For tailored assistance with your workplace governance framework, contact our corporate legal team.

  • Kenya Tax Guide for Foreign Investors: 2026 Setup Checklist

    Kenya Tax Guide for Foreign Investors: 2026 Setup Checklist

    Kenya Tax Guide for Foreign Investors: 2026 Setup Checklist

    Foreign investment in Kenya does not become a tax problem when the first annual return is due. It becomes a tax problem when the business model, contracts, payroll, invoicing and funding arrangements are set up without a common plan.

    This Kenya tax guide for foreign investors sets out the decisions to make before you incorporate, hire, import, invoice or pay a parent company. It is written for an international business establishing operations in Kenya, rather than a passive investor buying a listed security.

    Short answer: a Kenyan subsidiary is generally taxed at 30% and a non-resident company at 37.5% on Kenya-derived income. VAT is generally 16%, VAT registration is required at KES 5 million of annual taxable turnover, and corporate income tax returns are due by the end of the sixth month after the accounting period. Those headline figures matter, but the larger risk often sits in payroll, cross-border payments, related-party charges and the records supporting them. KRA’s corporate-tax guidance and company filing guidance confirm the current corporate rates and return timetable.

    Who this guide is for: foreign groups setting up a Kenyan subsidiary or branch, businesses entering Kenya through a distributor or digital platform, and investors planning a Kenyan acquisition, operating company or exit.

    Kenya tax guide for foreign investors, showing a red thread moving through a paper Kenya outline

    Start with the operating model, not the tax rate

    The right structure depends on what the Kenyan business will actually do. Who signs contracts? Where are employees based? Who owns the customer relationship, intellectual property and stock? How will the Kenyan business be funded? Where will services be performed?

    Those facts determine the tax analysis. A label such as “representative office” does not by itself prevent a Kenyan taxable presence if the activity on the ground is commercial.

    Operating modelCore tax questionWhat to settle before launch
    Kenyan subsidiaryWill the Kenyan company have the people, contracts and records needed to earn its margin?Funding, intercompany services, VAT position, payroll and dividend path.
    Kenyan branch or other permanent establishmentIs the non-resident carrying on business through a Kenyan taxable presence?Profit attribution, registrations, local compliance and remittance model.
    Distributor or agent modelIs the local party an independent distributor or creating a Kenyan taxable presence for the foreign principal?Contract authority, pricing, stock, customer terms and tax obligations.
    Digital or marketplace modelDo Kenyan users, VAT rules or significant-economic-presence rules create a Kenyan tax obligation?User location, service flow, platform role, registration and invoicing.

    Do not choose a subsidiary simply because a branch has a higher headline rate. The answer can turn on commercial liability, regulatory licences, financing, profit repatriation, permanent-establishment risk and the group’s future exit plan. Build the legal and tax model together.

    Kenya tax guide for foreign investors: key taxes at a glance

    Tax or obligationCurrent starting pointWhy it matters to an investor
    Corporate income tax30% for resident companies; 37.5% for non-resident companiesThe entity and taxable-presence analysis should be fixed before the first contract is signed.
    VAT16% general rateApplies to taxable supplies and imports. A VAT-registered business needs an invoice and input-tax process that works from day one.
    VAT registrationKES 5 million annual taxable turnover, with voluntary registration available in some casesRegistration may be required before the business reaches the threshold if it expects to do so.
    PAYEProgressive individual rates from 10% to 35%Employer registration, payroll configuration and benefits treatment need to be ready before the first salary run.
    Withholding taxDepends on payment type and recipient statusParent-company charges, interest, royalties and service fees should be reviewed before payment.
    Capital gains tax15% of net gain, generally a final taxThe exit route should be considered at acquisition and shareholder-agreement stage, not only on sale.

    Kenya also offers incentive regimes for qualifying operations. A Special Economic Zone enterprise, developer or operator may qualify for corporation tax at 10% for the first 10 years and 15% for the next 10 years. Certain Export Processing Zone enterprises can receive a 10-year corporate-tax holiday followed by a 25% rate for the next 10 years. These are eligibility-based regimes, not default outcomes. KRA’s investment-incentives guidance should be checked against the intended activity and licensing position before the investment model assumes a reduced rate.

    A note on small-business regimes and global minimum tax

    Turnover tax is not usually the right regime for an international operating company. KRA states that it is charged at 1.5% of gross sales for eligible resident businesses with turnover from KES 1 million to KES 50 million, and it does not apply to non-resident taxpayers. It also does not fit every type of income. KRA’s turnover-tax guidance is a useful starting point.

    At the other end of the scale, a very large multinational group should separately assess Kenya’s minimum top-up tax framework and its group-wide reporting requirements. An incentive or a low effective tax rate in one entity should not be assumed to settle the group-level analysis. The current Income Tax Act is the starting point, but this is an area for a tailored calculation.

    VAT, eTIMS and imported services: design the invoicing process early

    VAT is commonly where a new entrant discovers that an accounting issue is actually a tax-control issue.

    The general VAT rate is 16%. A business that supplies or expects to supply taxable goods and services worth KES 5 million or more in a year must register. A business below the threshold may be permitted to register voluntarily. VAT returns and payment are due by the 20th day of the following month. KRA’s VAT guidance also confirms that VAT-registered taxpayers must onboard eTIMS.

    For a foreign investor, the practical questions are more important than the rate:

    1. Is each supply taxable, zero-rated or exempt?
    2. Can the business issue compliant eTIMS invoices from the first commercial transaction?
    3. Are supplier invoices and purchase records sufficient to support input-VAT recovery?
    4. Is there VAT on a service purchased from a non-resident supplier?
    5. Does the business make digital supplies into Kenya that require non-resident VAT registration regardless of the KES 5 million threshold?

    Reverse VAT on services imported into Kenya

    Imported services can trigger reverse VAT. KRA states that any importer of an imported service is liable to pay it, irrespective of VAT-registration status, where the service is provided by a non-resident who is not required to register for Kenyan VAT. The tax point is the earliest of receiving the service, receiving the invoice or making payment. Tax paid for use in a registered person’s taxable business may be deductible as input tax in a later VAT return. See KRA’s explanation of VAT on imported services.

    This is why a software subscription, group-management charge, licence fee or overseas consultancy agreement should be reviewed before the first invoice is paid.

    Payroll in Kenya: build the full statutory stack into the first salary run

    Payroll should not be treated as a routine HR task. It is a monthly tax and statutory-compliance process.

    KRA requires an employer to deduct PAYE from employment income and remit both the tax and the PAYE return by the ninth day of the following month. The current PAYE bands range from 10% to 35%; personal relief is available to resident individuals, subject to the applicable rules. KRA’s PAYE guidance should be used to configure the first payroll and employee-benefit treatment.

    The payroll stack normally requires the following additional checks:

    ItemCurrent position to confirm in payroll setup
    Social Health Insurance FundThe regulations provide for a 2.75% monthly contribution based on gross salary or wage, subject to a KES 300 minimum. The employer needs to ensure the deduction and remittance process is configured correctly. Social Health Insurance Regulations
    Affordable Housing Levy1.5% of the employee’s gross monthly salary is deducted from the employee, and the employer contributes a matching 1.5%. KRA states that remittance is due by the ninth working day after month-end. KRA notice
    NSSFContributions sit within a phased statutory regime. Use the current annual NSSF employer notice and earning limits, rather than an old payroll template. NSSF employer notice
    NITA industrial training levyNITA states that employers should pay KES 50 per employee per month. It is an employer levy, not an employee payroll deduction. NITA guidance

    For expatriate staff, add a separate workstream for immigration status, Kenyan tax residence, employment-contract wording, benefits, tax equalisation and treaty analysis. Do not assume a foreign payroll arrangement eliminates Kenyan employment-tax exposure where services are performed in Kenya.

    Withholding tax: review every payment leaving Kenya before it is made

    Withholding tax is often the first cross-border tax cost a new Kenyan business sees. The payer must identify the payment type, the recipient’s tax status, the domestic rate, whether a treaty can reduce the rate, and the evidence needed to support the position.

    For common payments from a Kenyan company to a non-resident, KRA’s published domestic rates include:

    Payment to a non-residentStandard domestic withholding-tax rate
    Dividend15%
    Interest15%
    Royalty20%
    Management, professional or training fee20%
    Contractual payment, including certain construction or supply payments20%

    These are starting points, not a substitute for classifying the payment. Kenya’s rules vary by payment type and can include special treatment for instruments, recipients and regimes. KRA’s withholding-tax guidance should be read with the contract before payment.

    A valid double-tax agreement may reduce a non-resident rate, but treaty relief should not be assumed merely because the parent company is established in a treaty country. Confirm the recipient’s tax residence, beneficial ownership where relevant, the treaty article, the Kenyan documentation and the payment’s real character.

    Timing matters: KRA requires withholding tax to be remitted within five working days of deduction. For a non-resident with no permanent establishment in Kenya, the tax withheld is generally final tax. KRA’s withholding-tax FAQ sets out the current operational position.

    Related-party transactions: localise the transfer-pricing file before an audit does it for you

    Related-party transactions are not a year-end clean-up exercise. They should be documented when the group decides the price, service scope, financing terms or intellectual-property arrangement.

    The common risk areas are:

    • management and shared-service charges;
    • shareholder or intercompany loans;
    • royalties and software or intellectual-property licences;
    • supply-chain pricing;
    • guarantees; and
    • dealings between a non-resident and its Kenyan permanent establishment.

    Kenya’s transfer-pricing framework is grounded in section 18(3) of the Income Tax Act and the transfer-pricing rules. KRA describes the rules as heavily informed by OECD transfer-pricing guidelines. KRA’s transfer-pricing overview is a helpful introduction, but the group should maintain fact-specific evidence that its Kenyan terms are arm’s length.

    Groups should also assess country-by-country reporting, master-file and local-file obligations. The Income Tax Act uses KES 95 billion of consolidated group turnover as the current threshold for the country-by-country reporting provisions. See the current Income Tax Act.

    Digital businesses: significant economic presence tax and VAT can both apply

    A foreign business does not need a traditional office to trigger Kenyan tax questions.

    Significant economic presence tax, or SEPT, applies to a non-resident whose income from providing services accrues in or is derived from Kenya through a business carried out over a digital marketplace, where the user is located in Kenya. The current statutory framework excludes, among others, a non-resident offering the services through a Kenyan permanent establishment and a non-resident with annual turnover below KES 5 million. Taxable profit is deemed to be 10% of gross turnover and the rate is 30% of that deemed profit, which produces an effective 3% charge on gross turnover under the current formula. Section 12E of the Income Tax Act is the primary source.

    SEPT is separate from VAT. KRA says non-resident persons making supplies into Kenya over the internet, an electronic network or a digital marketplace must register for VAT whether or not they meet the KES 5 million VAT threshold. Map both obligations before pricing a Kenyan digital offer. KRA VAT guidance

    Imports and exits need a tax plan too

    If you import goods or equipment

    Tax and customs planning should be part of the procurement process, not a post-arrival reconciliation. Under the Finance Act 2026, KRA says that from 1 September 2026 importers must obtain and retain an export declaration, export entry, customs export certificate or equivalent document from the country of export. The record should support the importer, exporter, goods, quantity, value, tariff classification and country of export. KRA’s Finance Act 2026 guidance explains the operational change.

    If you expect to exit through a share sale

    Capital gains tax is currently charged at 15% of the net gain and is a final tax. KRA also identifies situations in which gains from indirect interests can be caught, including certain transfers involving non-residents and Kenyan shares or Kenyan immovable property. KRA’s capital-gains-tax guidance should be reviewed before signing the sale documents, not after completion.

    An investor should therefore decide early whether a future sale is more likely to be an asset sale, a sale of Kenyan shares or a sale higher up the group. The tax result can differ materially.

    A 90-day tax launch plan for a Kenyan operation

    This is the practical asset in this guide. Use it to sequence the work before the operation becomes difficult to unwind.

    Days 1 to 30: define the tax footprint

    1. Confirm the legal structure and who will sign Kenyan customer and supplier contracts.
    2. Map money flows: customer revenue, employee costs, imports, debt, dividends, management charges, royalties and service fees.
    3. Obtain the required KRA PINs and register the right tax obligations.
    4. Test VAT status, eTIMS onboarding and the first invoice flow.
    5. Identify any licence, SEZ, EPZ, customs or investment-certificate question before commercial activity begins.

    Days 31 to 60: make the recurring processes work

    1. Configure PAYE, Social Health Insurance Fund, Affordable Housing Levy, NSSF and NITA processes before the first salary run.
    2. Put related-party agreements in place and document the pricing method, deliverables and approvals.
    3. Create a withholding-tax review gate for every payment to a non-resident or related party.
    4. Set procurement rules for imported services, imported goods, eTIMS invoices and VAT-supporting records.

    Days 61 to 90: make the position defensible

    1. Build a monthly compliance calendar with named owners and backups.
    2. Reconcile tax returns to the general ledger, payroll and invoicing records.
    3. Create an evidence folder for key tax positions, treaty documents, invoices, contracts and transfer-pricing support.
    4. Review the exit route, shareholder documents and group funding before additional capital is injected.

    Kenya tax compliance calendar: the deadlines to put in your launch plan

    ObligationGeneral timing
    PAYE return and paymentBy the 9th day of the following month
    Affordable Housing LevyBy the 9th working day after month-end
    Social Health Insurance Fund contributionThe regulations specify the 9th day of the month for salaried households
    Withholding taxWithin 5 working days after deduction
    VAT return and paymentBy the 20th day of the following month
    Company income-tax returnBy the end of the sixth month after the accounting period ends

    Build the calendar around the company’s actual accounting period, contracts and payroll date. It is safer to create a single controlled calendar than to leave tax, finance, HR and procurement each managing one part of the same obligation.

    Frequently asked questions

    Does every foreign investor need a Kenyan company?

    No. The appropriate model depends on the activity, contracts, people, tax presence, regulatory position and funding structure. A subsidiary, branch, distributor, agent or digital model can each have different tax effects.

    When must a foreign business register for Kenyan VAT?

    The general VAT threshold is KES 5 million of annual taxable turnover. However, non-resident persons making supplies into Kenya over the internet, electronic network or digital marketplace have a separate VAT-registration rule. Check the model before the first supply.

    Can a Kenyan subsidiary pay management fees or royalties to its parent company?

    It can, but the payment must be correctly characterised, supported by a real service or licence arrangement, priced on arm’s-length terms and reviewed for withholding tax, VAT and treaty consequences before payment.

    Does a tax treaty automatically reduce withholding tax?

    No. Treaty relief is fact-specific. The recipient’s residence, the payment type, treaty wording, supporting documentation and any procedural requirements should be confirmed before the payment is made.

    What is the most common tax-control failure in a new Kenyan operation?

    Treating tax as a return-filing exercise. The exposure commonly begins earlier, in a contract, a payroll configuration, an overseas invoice, a missing eTIMS record or an unsupported related-party charge.

    Get the structure right before the first payment leaves Kenya

    MN Legal helps foreign investors align incorporation, contracts, tax registration, payroll setup, regulatory compliance and cross-border arrangements before they become expensive to unwind. Explore MN Legal’s practice areas or contact the firm to discuss a fact-specific market-entry plan.

    This article is for general information only and is not legal or tax advice. Kenyan tax law, KRA practice, exchange-rate effects and filing requirements can change. Obtain advice on your facts before acting. Last reviewed 3 September 2026.

  • DPIA Requirements in Kenya

    DPIA Requirements in Kenya

    DPIA Requirements in Kenya: 8 Critical AI Checks

    DPIA requirements in Kenya apply when data processing is likely to create a high risk to people’s rights and freedoms. If your organisation uses artificial intelligence to score, rank, recommend, monitor or make decisions about people, it may need a data protection impact assessment before the processing begins.

    That duty does not depend on Kenya passing a new AI statute. It already exists under section 31 of the Data Protection Act, 2019. The Office of the Data Protection Commissioner has also published a draft Guidance Note on Artificial Intelligence, signalling how the regulator expects existing data protection duties to apply across the AI lifecycle.

    The practical question is no longer whether AI creates privacy risk. It is whether your organisation can show that it identified and addressed that risk before deployment.

    Key point: Draft guidance is not law. The Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 are already in force.

    Quick overview

    • The DPIA requirements in Kenya come primarily from section 31 of the Data Protection Act, 2019 and regulations 49 to 53 of the General Regulations.
    • The assessment must be completed before high-risk processing begins.
    • AI systems used for automated decisions, biometrics, large-scale monitoring or sensitive data deserve early screening.
    • A vendor’s security certificate does not replace your organisation’s own DPIA.
    • The eight checks below provide a practical starting framework, not a substitute for advice on a specific deployment.

    What do the DPIA requirements in Kenya mean?

    A data protection impact assessment, usually called a DPIA, is a documented review of proposed processing that is likely to create a high risk to the rights and freedoms of individuals.

    Under section 31 of the Data Protection Act, a DPIA should describe the proposed processing and its purpose, assess whether the processing is necessary and proportionate, identify risks to data subjects, and record the safeguards that will address those risks.

    The assessment must take place before the processing. If the DPIA shows that a high risk remains, the controller or processor must consult the Data Commissioner before proceeding. The Act also requires DPIA reports to be submitted 60 days before processing.

    This timing matters. A DPIA completed after a system is already screening candidates or scoring customers is a record of an existing problem, not evidence that privacy risk shaped the deployment.

    Meeting the DPIA requirements in Kenya therefore starts at project design, not at launch.

    When do DPIA requirements in Kenya apply to AI?

    The legal test is whether the nature, scope, context and purpose of the processing make it likely to result in high risk to a data subject’s rights and freedoms.

    The General Regulations identify several warning signs that frequently appear in AI projects. These include automated decision making with legal or similarly significant effects, large-scale processing, biometric or genetic data, combining data from different sources, systematic monitoring, repurposing personal data and innovative uses of new technology.

    In practice, you should screen an AI deployment for a DPIA if it does any of the following:

    • scores people for credit, insurance, fraud or eligibility;
    • screens or ranks job applicants;
    • monitors employee activity or productivity;
    • uses facial recognition or other biometric data;
    • analyses health or patient records;
    • recommends content or offers based on behavioural profiles;
    • combines customer, employee or public datasets to infer new information; or
    • makes or materially influences a decision with significant consequences for an individual.

    The ODPC’s draft AI guidance reportedly gives concrete examples across finance, health, employment, education, authentication, recommendation systems and employee monitoring. Those examples are useful indicators of regulatory direction. Until the final note is issued, however, the safest publication position is to apply the statutory high-risk test rather than describe every reported example as a new mandatory rule.

    Automated decisions need more than a privacy notice

    Section 35 of the Act and regulation 22 address automated individual decision making. Where a system makes a decision without human involvement, organisations may need to provide meaningful information about the logic involved, explain the significance and likely consequences, prevent and correct errors, reduce discriminatory effects, and allow the data subject to obtain human intervention.

    A nominal human approval step does not necessarily solve the problem. The reviewer must have the authority, information and time to challenge the system’s recommendation. If staff routinely accept a score without examining it, the process may remain automated in substance.

    Your DPIA should therefore identify:

    • what the model recommends or decides;
    • which data influences the result;
    • the likely consequences for the person affected;
    • how accuracy, bias and model drift are tested;
    • who can override the output and on what basis; and
    • how a data subject can question or appeal the result.

    Publicly available data is not automatically free training data

    AI teams often assume that personal data may be used for model training because it appears on a public website, social network or registry. That assumption is unsafe.

    Kenya’s data protection principles still require a lawful basis, a specified purpose, transparency, data minimisation and appropriate retention. Public availability does not erase those duties. Nor does consent collected for one purpose automatically authorise a different use.

    For example, customer calls recorded for quality assurance do not automatically become lawful training data. Employment records gathered to administer payroll do not automatically become inputs for a performance model. A public professional profile does not automatically authorise scraping for an unrelated commercial system.

    Before using personal data to train, fine-tune, evaluate or ground an AI system, document where the data came from, the original purpose of collection, the lawful basis for the new use, the retention period, and whether anonymised or synthetic data could meet the same need.

    Your AI vendor does not carry your DPIA duty for you

    A third-party platform may provide security reports, model cards or compliance certificates. These documents can support due diligence, but they do not assess the risks created by your specific use of the tool.

    The controller remains responsible for understanding the deployment. That means knowing what personal data is sent to the vendor, where it is processed, whether sub-processors are involved, how long prompts and outputs are retained, whether submitted data is used to improve models, and how the vendor supports data subject rights.

    If the vendor will process personal data on your instructions, the engagement should also be governed by a written controller-processor contract that meets regulation 24. This is a separate obligation from the DPIA, and it should be addressed during procurement rather than after signature.

    8 checks for meeting DPIA requirements in Kenya

    A useful AI DPIA should answer eight practical questions. These checks turn the DPIA requirements in Kenya into an operational review:

    1. What is the system meant to do? Define the business purpose and the decision or workflow it affects.
    2. What personal data enters the system? Include prompts, attachments, logs, outputs, embeddings and inferred data.
    3. Where did the data come from? Record the source, original collection purpose and lawful basis.
    4. Who may be affected? Identify customers, employees, applicants, patients, children or other vulnerable groups.
    5. What could go wrong? Assess inaccurate outputs, bias, exclusion, data leakage, unauthorised reuse and inability to explain decisions.
    6. Is the processing necessary and proportionate? Consider less intrusive data, narrower access, shorter retention or meaningful human review.
    7. What does the vendor do? Document hosting locations, sub-processors, training practices, security controls, deletion and incident support.
    8. Who owns the controls? Name the accountable business owner, privacy lead, security lead and human decision-maker.

    The result should be a living governance record. Review it when the model, data source, purpose, vendor or affected population changes.

    Documenting these decisions is central to meeting the DPIA requirements in Kenya and showing why the residual risk was accepted.

    A 30-day AI data protection plan

    Week 1: Build an AI system register

    List every tool that scores, ranks, predicts, recommends, transcribes, generates, matches, flags or monitors. Include software bought directly by HR, marketing, finance and operations.

    Week 2: Map the data flows

    Record the categories of personal data involved, data subjects, processing locations, recipients, sub-processors, retention periods and cross-border transfers.

    Week 3: Prioritise high-risk uses

    Start with employment, credit, health, biometrics, systematic monitoring and decisions with significant effects. Confirm whether each deployment has a current DPIA.

    Week 4: Close the contracting and control gaps

    Complete or update the highest-priority DPIAs. Review AI vendor contracts against regulation 24. Confirm human oversight, incident notification, deletion, audit and transfer safeguards.

    Frequently asked questions about DPIA requirements in Kenya

    Is a DPIA mandatory in Kenya?

    Yes, where a processing operation is likely to result in high risk to a data subject’s rights and freedoms. Section 31 sets the legal test. The facts of the proposed processing determine whether it applies.

    Must a DPIA be completed before using an AI tool?

    If the proposed AI processing is likely to create high risk, the assessment must be carried out before processing. Procurement and pilot testing should therefore include DPIA screening before live personal data is used.

    Does an overseas AI vendor’s DPIA cover a Kenyan customer?

    Not necessarily. A vendor’s assessment may provide useful evidence, but it does not evaluate your purpose, users, data subjects, decisions or local legal duties. Your organisation must assess the risk created by its own deployment.

    Who should conduct an AI DPIA?

    The work should bring together the business owner, privacy or data protection lead, information security team, procurement or legal team, and the people responsible for meaningful human oversight. Technical and operational input is essential.

    Do not wait for the final AI guidance

    The ODPC’s draft note may change before it is finalised. The statutory duties behind it will not disappear.

    An organisation that acts now can show that it identified high-risk processing, tested necessity and proportionality, documented safeguards and assigned accountable human oversight. An organisation that waits may have to assemble the same evidence after an incident, complaint or regulatory inquiry.

    The DPIA requirements in Kenya are designed to make that assessment happen before an AI system begins making decisions about people.

    MNL Advocates advises banks, fintechs, health providers, employers and technology businesses on DPIAs, automated decision making and responsible AI deployment. To assess a proposed system or review tools already in use, contact our Data Privacy & Protection team.

    Suggested internal links before publication

    • Link “controller-processor contract” to Article 2 below.
    • Link “cross-border transfers” to the firm’s existing cross-border data transfer service or insight page.
    • Link the closing CTA to the firm’s Data Privacy & Protection practice page.

    Primary sources for editorial review

    Pre-publication note

    Confirm whether the ODPC has issued a final Guidance Note on Artificial Intelligence. If it has, update the draft-status language and verify any named examples against the final document.

  • Commercial Arbitration in Kenya in 2026: A Complete Business Guide

    Commercial Arbitration in Kenya in 2026: A Complete Business Guide

    commercial arbitration in Kenya MN Legal

    Quick Overview

    Commercial arbitration in Kenya is one of the fastest paths to resolving a business dispute without going through the court system. If your contract has a dispute resolution clause, or you are dealing with a counterparty who refuses to perform, your arbitration options right now could save your business months of expensive litigation. This guide covers the full process under the Arbitration Act, Cap. 49, the landmark January 2026 Court of Appeal ruling on award finality, and what the Arbitration (Amendment) Bill 2025 means for businesses operating in Kenya.

    What Is Commercial Arbitration in Kenya?

    Commercial arbitration in Kenya is a private, binding process for resolving business disputes outside the courts. A neutral third party, the arbitrator, hears both sides and issues an award. That award is enforceable in the same way as a court judgment.

    The governing statute is the Arbitration Act, Cap. 49 (originally enacted in 1995, revised in 2012). It is modelled closely on the UNCITRAL Model Law, which means Kenya-seated awards align with international standards and are recognisable across most jurisdictions.

    Your business can use commercial arbitration in Kenya when your contract contains an arbitration clause, or when both parties agree to arbitrate after a dispute arises. Courts in Kenya consistently respect and enforce written arbitration agreements.

    Practical rule: If you are signing any commercial contract with a counterparty in Kenya or East Africa, include a well-drafted arbitration clause now. Retrofitting it after a dispute arises requires the other party’s consent, which you are unlikely to get when a dispute has already started.

    Arbitration vs. Litigation: What Your Business Needs to Know

    Litigation and arbitration serve different needs. The right choice depends on your dispute, your contract, and your commercial priorities.

    Factor Arbitration Litigation
    Privacy Proceedings are private Proceedings are public record
    Speed Variable; can be faster with tight timelines Can take years in Kenya’s courts
    Cost Higher upfront (arbitrator fees: USD 150-800/hour) Lower court fees; costs vary with complexity
    Expertise Arbitrator can be a sector specialist Judges handle all case types
    Finality Award is final; very limited grounds to challenge Multiple appeal levels available
    Enforceability Enforceable globally under the New York Convention Enforceable domestically and by treaty

    Arbitration works best for high-value commercial disputes where confidentiality matters and the parties want a specialist decision-maker. Litigation is appropriate when costs are the primary concern, or the dispute involves a remedy only a court can grant, such as an injunction or a contempt order.

    Important context: Kenya’s courts have been consistent in refusing to intervene in arbitration proceedings without strong cause. The January 2026 Court of Appeal ruling has made that position even more pronounced.

    From our experience: Most businesses draft arbitration clauses as boilerplate, then discover how important the specific wording is when a dispute actually starts. The dispute resolution clause deserves the same attention as the payment clause.

    The Legal Framework for Commercial Arbitration in Kenya

    Commercial arbitration in Kenya operates under three layers of authority.

    1) The Arbitration Act, Cap. 49. This is the primary statute. It governs the validity of arbitration agreements, appointment of arbitrators, conduct of proceedings, and recognition and enforcement of awards.

    2) The Nairobi Centre for International Arbitration Act, No. 26 of 2013. This established the NCIA as a government-backed institution to administer both domestic and international arbitrations. The NCIA published its most recent procedural rules in 2019, which parties can adopt by reference in their arbitration clause.

    3) Party agreement. Within the framework of the Act, parties have wide freedom to agree on the number of arbitrators, how they are appointed, the seat of arbitration, the language, and the applicable substantive law.

    Important context: If your arbitration clause does not specify institutional rules or a procedure for appointing an arbitrator, disputes about the clause itself may end up before the court before any substantive arbitration begins.

    Key 2026 Developments in Commercial Arbitration in Kenya

    The landscape for commercial arbitration in Kenya has shifted in the first half of 2026:

    • Award finality reinforced (January 2026): The Court of Appeal held in County Government of Kitui v Power Pump Technical Company Limited (Civil Appeal 176 of 2020) that a party cannot challenge an arbitral award through judicial review after failing a Section 35 application. [[1]](https://www.cliffedekkerhofmeyr.com/en/news/publications/2026/Kenya/Dispute-Resolution/dispute-resolution-alert-3-march-No-second-bite-at-the-cherry-Court-of-Appeal-bars-judicial-review-of-arbitral-awards-after-failed-section-35-challenge)
    • Arbitration (Amendment) Bill 2025 before Parliament: The Bill introduces emergency arbitration, third-party funding disclosure requirements, and a new specialist Arbitral Court. It is currently under parliamentary review. [[2]](https://globalarbitrationreview.com/review/the-middle-eastern-and-african-arbitration-review/2026/article/kenya-arbitration-amendment-bill-2025-signals-reset-nairobis-arbitral-ambitions)
    • Nairobi emerging as a regional hub: Kenya is increasingly the preferred seat for East African disputes, supported by an English common law system and improving institutional infrastructure. [[3]](https://www.cliffedekkerhofmeyr.com/en/news/publications/2026/Kenya/Corporate-Commercial/how-Kenyas-success-in-alternative-dispute-resolution-ADR-is-positioning-the-country-as-a-leading-hub-for-African-arbitration)
    • Cost concerns for SMEs persist: Arbitrator fees in Kenya run from USD 150 to USD 800 per hour depending on seniority and dispute complexity. For lower-value disputes, mediation may be a more proportionate first step. [[4]](https://koyaadvocates.co.ke/alternative-dispute-resolution-in-business-disputes-and-arbitration-in-kenya/)

    The January 2026 Ruling Every Business With a Commercial Contract Should Know

    On 30 January 2026, the Court of Appeal decided County Government of Kitui v Hon. Justice E. Torgbor and Power Pump Technical Company Limited (Civil Appeal 176 of 2020). This ruling is now one of the most important decisions on award finality in recent Kenyan arbitration jurisprudence. [[1]](https://www.cliffedekkerhofmeyr.com/en/news/publications/2026/Kenya/Dispute-Resolution/dispute-resolution-alert-3-march-No-second-bite-at-the-cherry-Court-of-Appeal-bars-judicial-review-of-arbitral-awards-after-failed-section-35-challenge)

    The question before the court was direct: can a party that has already failed to set aside an arbitral award under Section 35 of the Arbitration Act seek judicial review of that same award?

    The court’s answer was no.

    Section 35(2) of the Arbitration Act, Cap. 49 sets out eight grounds on which a party may apply to the High Court to set aside an award. These include: a party to the arbitration agreement was under incapacity; the agreement was invalid; proper notice was not given; the award went beyond the scope of the reference; the tribunal’s composition breached the agreement; or the award conflicts with Kenyan public policy. An application under Section 35 must be filed within three months of receiving the award.

    The Court of Appeal found that where a party has invoked this regime and failed, judicial review is not available as a fallback. The Arbitration Act creates a self-contained statutory framework. Repackaging a failed Section 35 challenge as a judicial review application is not permissible.

    What this means for your business: If you receive an arbitral award you believe is wrong, your window to challenge it is narrow. File a Section 35 application within three months. Make that application your strongest possible case. After that window closes, the award stands.

    Practical rule: When you receive any arbitral award, have a lawyer assess the Section 35 grounds within the first two weeks. The three-month clock is strict, and the January 2026 ruling has removed the judicial review route entirely.

    The Arbitration Amendment Bill 2025: What Businesses Need to Know

    The Arbitration (Amendment) Bill 2025 is currently before Parliament. Once enacted, it will represent the most significant update to Kenya’s arbitration framework since the original Arbitration Act was passed in 1995. Key provisions of the Bill include the following.

    1) Emergency Arbitration. The Bill resolves a longstanding ambiguity by expressly including emergency arbitrator decisions within the definition of “award.” Emergency arbitrator orders will be enforceable in the same way as final awards, provided the parties have consented to emergency arbitration procedures under their chosen institutional rules. [[2]](https://globalarbitrationreview.com/review/the-middle-eastern-and-african-arbitration-review/2026/article/kenya-arbitration-amendment-bill-2025-signals-reset-nairobis-arbitral-ambitions)

    2) Third-Party Funding Disclosure. The Bill introduces a new Section 39A to regulate third-party funding in international arbitration seated in Kenya. Funded parties will be required to disclose the existence of the funding arrangement, the identity of the funder, and the nature of the arrangement to the tribunal and the opposing party. This aligns Kenya with standards adopted in Singapore and Hong Kong. [[2]](https://globalarbitrationreview.com/review/the-middle-eastern-and-african-arbitration-review/2026/article/kenya-arbitration-amendment-bill-2025-signals-reset-nairobis-arbitral-ambitions)

    3) A Specialist Arbitral Court. The Bill formalises a new Arbitral Court with a dedicated Registrar to handle arbitration-related applications. This channels disputes to judges with arbitration expertise rather than the general commercial division.

    4) Summary Determination. The Bill gives tribunals power to summarily dismiss claims or defences that have no real prospect of success, reducing the ability to use arbitration proceedings as a delay tactic.

    Important context: The Arbitration (Amendment) Bill 2025 is proposed legislation, not yet in force as at the date of this article. Check its current parliamentary status before relying on any of its provisions. The Arbitration Act, Cap. 49 remains the governing statute.

    How Commercial Arbitration in Kenya Works: Step by Step

    Understanding the procedural sequence prevents the mistakes that derail valid claims.

    Step 1: Check your contract for a dispute resolution clause.

    Most commercial contracts contain an arbitration clause specifying whether the process is ad hoc or institutional. Read the clause carefully before taking any other step. The clause will dictate everything that follows.

    Step 2: Follow any pre-arbitration steps.

    Multi-tier clauses requiring negotiation or mediation before arbitration are common and enforceable in Kenya. Courts will enforce these pre-conditions. If your contract requires 30 days of negotiation before arbitration can begin, you should not skip that step.

    Step 3: Issue a notice of arbitration.

    The claimant sends written notice to the respondent stating that the dispute is being referred to arbitration, identifying the nature of the dispute, and invoking the arbitration clause. If you are using NCIA Rules, the notice must meet NCIA’s formal requirements.

    Step 4: Appoint the arbitrator or tribunal.

    The clause will specify the number of arbitrators and the appointment mechanism. A sole arbitrator is common for lower-value disputes. A three-member tribunal is used for complex or high-value matters. Where the parties cannot agree, the court or the NCIA may be asked to make the appointment.

    Step 5: Settle the terms of reference.

    The tribunal and parties agree on the issues in dispute, the procedure, the timeline, and the venue. This step sets the boundaries of what the tribunal will decide.

    Step 6: Exchange statements and evidence.

    Each party files its statement of claim or defence, supported by documents and witness statements. Disclosure obligations in arbitration are limited compared to court litigation, which helps manage costs.

    Step 7: The hearing.

    The tribunal hears witnesses and legal submissions. In simpler cases the tribunal may decide on documents alone, without a hearing.

    Step 8: The award.

    The tribunal issues a written award. It is binding on both parties. It is enforceable in Kenya under the Arbitration Act, Cap. 49, and internationally under the New York Convention on the Recognition and Enforcement of Foreign Arbitral Awards (Kenya acceded in 1989).

    Bottom line: Commercial arbitration in Kenya follows a structured sequence, but every step requires procedural compliance. A procedural failure can delay the proceedings or give the other side grounds to challenge the award under Section 35.

    Who Needs Commercial Arbitration Support in Kenya?

    Commercial arbitration in Kenya is relevant across a wide range of business types. Here are the situations we see most often.

    Contractors and subcontractors: Construction contracts in Kenya frequently require NCIA arbitration. Payment disputes and scope disagreements are the most common triggers.

    Foreign investors: Businesses investing in Kenya prefer arbitration because it offers a neutral forum and an internationally enforceable award, rather than a domestic court judgment that may be difficult to recognise abroad.

    Financial institutions: Banks and lenders use arbitration clauses in facility agreements to resolve default and enforcement disputes privately and outside the court’s public record.

    Technology and fintech companies: Commercial arrangements in this sector move fast. Confidentiality and specialist arbitrators make arbitration the preferred mechanism for contract disputes.

    Business partners in shareholder disputes: When a partnership or shareholder relationship breaks down, an arbitration clause in the shareholder agreement provides a structured, private path through the dispute.

    Common Mistakes Businesses Make in Commercial Arbitration in Kenya

    1) Drafting a vague arbitration clause.

    The clause must specify: the number of arbitrators, the method of appointment, the seat of arbitration, the institutional rules (if any), and the governing law. A clause that says only “disputes shall be referred to arbitration” leaves too much undefined and invites a court application before any merits are heard.

    2) Missing the Section 35 deadline.

    You have three months from receiving the award to apply to set it aside. This is a hard deadline. The January 2026 Court of Appeal ruling closes the judicial review door once that window passes.

    3) Ignoring pre-arbitration steps in a multi-tier clause.

    If your clause requires 30 days of good faith negotiation before arbitration begins and you skip that step, the respondent can challenge the tribunal’s jurisdiction.

    4) Choosing an arbitrator without sector knowledge.

    A commercial arbitration in Kenya involving a fintech or construction dispute needs an arbitrator who understands the sector. General legal experience is not enough for specialist matters.

    5) Treating arbitration like court litigation.

    Arbitration has different disclosure rules, timelines, and procedures. Running it like a court case drives up costs without the procedural protections that court litigation provides.

    From our experience: The disputes that produce the worst outcomes are ones where the arbitration clause was drafted without legal input and the procedural framework was left ambiguous. A short review at the contract stage prevents years of procedural uncertainty.

    How MN Legal Handles Commercial Arbitration in Kenya

    MN Legal is a Nairobi-based commercial law firm. Our Litigation and Dispute Resolution practice covers the full spectrum: domestic commercial arbitration in Kenya, international arbitration, mediation, debt recovery, shareholder disputes, and judicial review.

    Mutundu Chege co-heads the litigation practice. He has represented commercial banks, manufacturing conglomerates, and telecom companies in landmark cases before Kenya’s superior courts and arbitral tribunals.

    MN Legal also has a London-based Of Counsel, Konstantina Zariou, who specialises in international arbitration. Clients with cross-border commercial disputes, particularly those with a European or UK counterparty, benefit from counsel who understands both Kenyan and international arbitration frameworks. This is a depth that most Nairobi-only practices cannot match.

    We handle the full cycle of commercial arbitration in Kenya: contract review and clause drafting, pre-arbitration advisory, representation through the hearing, and post-award enforcement or challenge.

    Practical rule: Engage an arbitration lawyer before you receive an adverse award. The best time to build a case is when the dispute is still being framed, not after the award has been issued and the Section 35 clock is running.

    If you are dealing with a commercial dispute now, or you want your contracts reviewed for arbitration readiness, contact MN Legal.

    FAQs

    What Is Commercial Arbitration in Kenya?

    Commercial arbitration in Kenya is a private dispute resolution process in which a neutral arbitrator or tribunal hears and decides a business dispute. It is governed by the Arbitration Act, Cap. 49 and produces a binding award that is enforceable in Kenya and internationally under the New York Convention. It is used as an alternative to court litigation for contract disputes, shareholder disagreements, and other commercial matters.

    How Does Commercial Arbitration in Kenya Differ From Mediation?

    In arbitration, the arbitrator imposes a binding decision on both parties. In mediation, a neutral facilitator helps the parties reach a voluntary settlement. Neither party can be forced to settle in mediation. Arbitral awards, like court judgments, can be enforced against an unwilling party. Most Kenyan commercial contracts use a multi-tier clause requiring mediation or negotiation before arbitration begins.

    What Are the Grounds to Set Aside an Arbitral Award in Kenya?

    Section 35(2) of the Arbitration Act, Cap. 49 provides eight grounds: incapacity of a party, invalidity of the arbitration agreement, lack of proper notice, the award going beyond the scope of the reference, improper tribunal composition, conflict with Kenyan public policy, the subject matter not being arbitrable, or the award being procured by fraud, bribery, or undue influence. The application must be filed within three months of receiving the award.

    Can a Failed Section 35 Challenge Be Brought Back as a Judicial Review?

    No. The Court of Appeal ruled in January 2026 in County Government of Kitui v Power Pump Technical Company Limited that a party that has already failed to set aside an award under Section 35 cannot seek judicial review of the same award. The Arbitration Act, Cap. 49 creates a self-contained regime. Judicial review is not available as a second attempt after the statutory route has failed.

    Is Commercial Arbitration in Kenya Confidential?

    Yes. Unlike court proceedings, arbitration hearings and awards in Kenya are private. The parties and the tribunal are generally bound to keep the proceedings confidential unless the parties agree otherwise or disclosure is required by law. This confidentiality is one of the primary reasons businesses prefer arbitration for sensitive commercial disputes.

    How Long Does Commercial Arbitration in Kenya Typically Take?

    The timeline depends on the complexity of the dispute, the efficiency of the arbitrator, and whether the parties comply with procedural directions. Simpler disputes can conclude in six to twelve months. Complex commercial matters may take two to three years. Proceedings under the NCIA Rules include procedural timelines, but compliance depends on both parties.

    How Much Does Commercial Arbitration in Kenya Cost?

    Arbitrator fees in Kenya range from approximately USD 150 to USD 800 per hour, depending on the arbitrator’s seniority and the nature of the dispute. [[4]](https://koyaadvocates.co.ke/alternative-dispute-resolution-in-business-disputes-and-arbitration-in-kenya/) Institutional fees, venue costs, and legal representation add to the total. For lower-value matters, mediation is often more proportionate.

    What Is the NCIA and How Does It Support Commercial Arbitration in Kenya?

    The Nairobi Centre for International Arbitration (NCIA) was established by the Nairobi Centre for International Arbitration Act, No. 26 of 2013 as a government-backed institution to administer both domestic and international arbitrations. It provides procedural rules (last revised in 2019), a panel of arbitrators, and administrative support for proceedings. Parties who include NCIA Rules in their arbitration clause give the NCIA a role in administering the process and resolving procedural disputes.

    What Does the Arbitration Amendment Bill 2025 Mean for Businesses?

    The Arbitration (Amendment) Bill 2025, currently before Parliament, proposes four main changes to commercial arbitration in Kenya: it formalises emergency arbitration and makes emergency orders enforceable; it requires disclosure of third-party funding arrangements; it introduces a specialist Arbitral Court; and it gives tribunals summary determination powers. Once enacted, it will be the first major update to the Arbitration Act since 1995. The existing Act governs until then.

    Is a Kenyan Arbitral Award Enforceable Internationally?

    Yes. Kenya acceded to the New York Convention on the Recognition and Enforcement of Foreign Arbitral Awards in 1989. An award issued in a Kenya-seated arbitration is enforceable in over 170 countries that are party to the Convention. For cross-border commercial disputes, this enforceability is a significant practical advantage over a domestic court judgment.

    Which Firms Handle Commercial Arbitration in Kenya?

    MN Legal handles both domestic and international commercial arbitration in Kenya through its Litigation and Dispute Resolution practice. Mutundu Chege co-heads the team with experience representing commercial banks, manufacturers, and telecoms in high-stakes proceedings. Konstantina Zariou, MN Legal’s London-based Of Counsel, adds international arbitration depth for cross-border matters. The team covers the full cycle: clause drafting, pre-arbitration strategy, representation at hearings, and post-award enforcement.

    Extra Resources

    Citations

    [1] Cliffe Dekker Hofmeyr. (2026, March 3). No second bite at the cherry: Court of Appeal bars judicial review of arbitral awards after failed section 35 challenge. CDH Dispute Resolution Alert.

    [2] Global Arbitration Review. (2026). Kenya: Arbitration (Amendment) Bill 2025 signals a reset for Nairobi’s arbitral ambitions. The Middle Eastern and African Arbitration Review 2026.

    [3] Cliffe Dekker Hofmeyr. (2026). How Kenya’s success in alternative dispute resolution is positioning the country as a leading hub for African arbitration. CDH Corporate Commercial Alert.

    [4] Koya and Company Advocates. (2023). Alternative Dispute Resolution in Business Disputes and Arbitration in Kenya.

    [5] Kenya Law. (2022). Arbitration Act, Cap. 49 (Revised Edition 2022).

    [6] Nairobi Centre for International Arbitration. (2019). NCIA Arbitration Rules 2019.

    Legal Disclaimer

    This article is intended for general informational purposes only and does not constitute legal advice. The information provided does not create an attorney-client relationship between MN Legal (MN Advocates LLP) and the reader. Laws and regulations change; confirm current status with qualified legal counsel before acting on anything in this article. For advice specific to your situation, contact MN Legal.