The Central Bank of Kenya (CBK) has released its 2025 Bank Supervision Annual Report, and buried in nearly 180 pages of regulatory detail is a clear story of how the country’s banks are no longer just banks.
They’re becoming data companies, AI shops, and cybersecurity operations that happen to also take deposits. CBK runs a yearly Innovation Survey to track this shift, and the 2025 numbers back it up.
Most banks now describe themselves as trying to become “better banks,” meaning they’re using fintech to upgrade what they already do rather than rebuilding from scratch or handing the customer relationship to outside startups.
71% of institutions put themselves in that category. A smaller group, 17%, are betting on partnerships with fintech startups instead. Only 8% are trying to build fully digital-native banks from the ground up.
Two-thirds of banks now have a dedicated innovation team, up slightly from the year before. Nearly all of them, 96%, have some kind of mobile banking app or USSD service.
The one place that hasn’t caught up is credit: over a third of banks still say lending is the least digitized part of their business.
| Strategy Type | Share of Institutions | What It Means |
|---|---|---|
| Better Bank | 71% | Upgrading existing operations with fintech tools |
| Distributed Bank | 17% | Partnering with fintech startups |
| New Bank | 8% | Building fully digital-native banking platforms |
The plumbing behind all this innovation is increasingly standardized. 84% of commercial banks and 79% of microfinance banks have adopted APIs, making it the single most common piece of new banking tech.
Cloud computing, big data analytics, and biometric authentication are each running at around 45% adoption.
However, the survey also flagged the tradeoff. Cyber risk is now the top concern tied to innovation for 82% of commercial banks and 93% of microfinance banks.
That’s been true every year since 2018, but it’s getting more pointed as institutions plug in more third-party vendors and cloud providers. Operational risk jumped to the second-biggest worry this year, overtaking compliance risk, which had held that spot in 2024.
CBK ran a separate survey specifically on AI in March 2025, and it found that half of all surveyed institutions have adopted some form of AI. That breaks down to 66% of commercial banks, 57% of microfinance banks, and 43% of digital credit providers.
Credit reference bureaus were the outlier: none of them had adopted AI yet.
The technology is mostly being pointed at three jobs: credit risk assessment (65% of institutions use it for this), cybersecurity (54%), and customer service (43%).
Most institutions plan to expand into more of these use cases soon, with over 80% saying they’re likely to lean on AI for credit scoring, fraud detection, and identity verification in the near future.
| Institution Type | AI Adoption Rate |
|---|---|
| Commercial Banks | 66% |
| Microfinance Banks | 57% |
| Digital Credit Providers | 43% |
| Credit Reference Bureaus | 0% |
| All Institutions (average) | 50% |
The gap between using AI and governing it properly is wide, though. Only 30% of institutions have a formal AI strategy, even though 62% have dedicated data or AI teams.
The most commonly cited obstacles were a shortage of AI-skilled staff, high implementation costs, and uncertainty around data governance rules.
93% of respondents told CBK they want the regulator to issue formal AI guidance covering governance, risk management, and incident reporting. That’s about as close to an industry-wide request for rules as you’ll see in a survey like this.
CBK is already moving in that direction. In November 2025 it ran an AI hackathon themed “Ethical and Responsible AI in the Financial Sector,” which pulled in 272 applications from teams across eight African countries. 15 finalists from five countries made it to a demo day in Nairobi.
The winner was a Botswana-based startup that built an AI system for automating regulatory compliance checks, with semantic search and real-time monitoring built in.
Two Kenyan teams took second and third place: one building AI-driven credit scoring for smallholder farmers, the other building an incident-reporting platform for financial sector cybersecurity.
| Use Case | Current Adoption | Planned Future Adoption |
|---|---|---|
| Credit Risk Assessment | 65% | 83% |
| Cybersecurity | 54% | 82% |
| Customer Service | 43% | 82% |
| Electronic KYC | — | 82% |
A third CBK survey looked specifically at third-party technology providers, and the findings explain why cybersecurity keeps topping every risk list.
Every single commercial bank and microfinance bank surveyed said they rely on external vendors for at least part of their operations, most commonly cloud services, mobile banking infrastructure, and internet banking.
Cybersecurity and data privacy were named the biggest challenge in managing these vendor relationships by 38 of 52 respondents.
Most institutions have responded with formal governance: all commercial banks and 93% of microfinance banks now have structures in place for managing third-party risk, and the vast majority ask vendors to show compliance with standards like ISO 27001 or PCI-DSS.
Still, a chunk of banks, especially smaller ones, say their internal processes for spotting third-party risk are still being built out.
CBK plans to use this data to update its outsourcing guidelines, which currently haven’t kept pace with how dependent banks have become on outside tech.
While banks debate strategy, Kenya’s digital credit providers just had an explosive year. These are the licensed apps and platforms offering short-term digital loans, separate from traditional banks.
CBK had licensed 195 of them by the end of 2025, more than double the 85 that were licensed at the end of 2023.
Outstanding loans from these providers rose from KES 55.2 billion in December 2024 to KES 110.1 billion in December 2025, a 99.6% jump. The number of active loan accounts grew 71%, hitting 6.74 million by year end.
Average loan sizes barely moved, which suggests the growth is coming from more borrowers and more providers rather than people taking out bigger loans.
CBK has tightened oversight in step with this growth, adding requirements around pricing transparency, responsible lending, and how these companies handle customer data.
| Metric | Dec 2023 | Dec 2024 | Dec 2025 |
|---|---|---|---|
| Licensed Digital Credit Providers | 85 | 85 | 195 |
| Outstanding Loans (KES billions) | — | 55.2 | 110.1 |
| Active Loan Accounts (millions) | — | 3.9 | 6.74 |
Here’s a counterintuitive one. Kenya’s mobile subscriber base grew 10% to 78.4 million people in 2025, and mobile money subscriptions grew even faster, up 22% to 51.4 million.
Yet, the number of mobile money transactions dropped 30%, from 309.3 million to 217.6 million, and total transaction value slipped 4%.
CBK’s read on this is that it’s not a sign of mobile money losing relevance. It’s a sign of consolidation.
People are making fewer, larger transactions instead of lots of small ones, and more payments are shifting to merchant payment systems and mobile banking apps that bypass the traditional agent cash-in, cash-out model entirely.
The agent network itself kept growing regardless, up 24% to over 473,000 agents, still doing heavy lifting in rural areas where digital alternatives haven’t fully arrived.
Kenya passed its first dedicated law for virtual assets in 2025. The Virtual Asset Service Providers Act was signed on October 15 and took effect on November 4.
It splits oversight between two regulators: CBK will license and supervise wallet providers, payment processors, and stablecoin issuers, while the Capital Markets Authority (CMA) takes crypto exchanges, brokers, investment advisors, and token issuance platforms.
This follows a 2023 national risk assessment that flagged virtual assets as vulnerable to money laundering because transactions can move fast, be pseudonymous, and cross borders easily.
In the Innovation Survey, 35% of banks said they already see virtual assets as relevant to their innovation plans.
Draft regulations spelling out licensing procedures were still being written as of December 2025, so the next real test is whether CBK can turn the law into a working licensing regime within its one-year compliance window.
Put together, the picture is one of a banking sector that’s automating fast, outsourcing heavily, and asking its regulator for clearer rules faster than the regulator can write them. Digital lending is booming, AI adoption crossed 50%, and crypto has its first real law.
The next annual report will show whether the guidance CBK has promised on AI and third-party vendors actually arrives, and whether it can keep pace with an industry that’s clearly not waiting around.
Comments
No comments yet. Be the first to share your thoughts.