Digital Lender Loan Reminder SMS in Kenya: CBK Rules

A compliant loan reminder SMS from a Kenyan digital lender goes only to the borrower, names the licensed lender, states the amount, due date and how to pay by M-Pesa, and never threatens, shames or involves the borrower's contacts. Those limits come from the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022, which also require a receipt for every transaction, 30 days' notice before negative credit bureau listing and an opt-out from marketing messages.

Last reviewed: 27 October 2026

This guide is for compliance teams, product managers and engineers at CBK-licensed digital credit providers. It maps the regulations that touch SMS, gives a message sequence from disbursement to clearance, and shows how to automate it. It is not legal advice; check edge cases with the CBK or your counsel.

Why messaging is a compliance issue for Kenyan lenders

Debt-shaming by text, where a lender messages a borrower's relatives, colleagues or employer about an overdue loan, was a widely reported complaint before the CBK began licensing digital lenders. The 2022 regulations now prohibit that conduct directly, and the Office of the Data Protection Commissioner (ODPC) has penalised lenders for unwanted messages. In David Owuor & 2 others v Ceres Tech Limited t/a Rocketpesa, as summarised by Afriwise, the ODPC awarded KES 2,600,000 in total to three complainants who received promotional messages and calls without consent or an opt-out, after the company had already received an enforcement notice.

The lesson is that your SMS templates and sending rules are regulated artefacts. Treat them like your loan agreement: version them, approve them and keep a record of what went to whom.

What the Digital Credit Providers Regulations require

Regulation	What it means for your SMS
13	Keep customer information confidential; do not share it with anyone without the customer's consent or legal authority
14(3)	No negative credit bureau listing where the outstanding amount does not exceed one thousand shillings
14(5)	Notify the customer in writing or electronically at least 30 days before submitting negative information to a bureau (a contract may shorten this, but not below 7 days)
14(6)	Within 30 days of submitting information, tell the customer it has been sent to the bureau
20	No threats, no obscene or profane language to the customer or their references or contacts, no accessing the phone book to message contacts, no posting personal information to shame, no unsolicited calls or messages to the customer's contacts, no harassment
21	Issue a receipt or acknowledgement for every transaction, electronically or by another acceptable medium
22	Run a complaints channel, communicate it to customers and resolve complaints within 30 days
25(d) and (e)	Disclose that you are regulated by the Bank, and disclose your identity in correspondence
26(2)	Give customers a way to opt out of marketing messages
27	Give full terms before the loan, including amount, charges, interest, total cost of credit, annual percentage rate and complaint channels; give 30 days' notice of changes

Two of these change how most lenders design messages. Regulation 14(5) and 14(6) turn credit bureau listing into a two-message process: a pre-listing notice with a deadline, then a notice that the information was sent. Regulation 25(d) and (e) mean the lender's identity and regulated status should be clear in customer communications, which is why the disbursement message below says "Regulated by CBK".

A message sequence from disbursement to clearance

Kiboko Credit is a fictional lender. Amounts are in Kenyan shillings and repayment is by M-Pesa paybill with the phone number as account, the most common pattern for app lenders.

Stage	Sample message
Disbursement	Kiboko Credit: KES 5,000 sent to your M-Pesa. Repay KES 5,750 by 30/11. Terms and APR at kibokocredit.example/terms. Regulated by CBK.
Repayment receipt	Kiboko Credit: We received KES 2,000 on 20/11. Balance KES 3,750, due 30/11. Ref KB88213. Queries 0700000000
3 days before due	Kiboko Credit: Hi Mwangi, KES 3,750 is due on 30/11. Pay via M-Pesa Paybill 5xxxxx, Account 0712xxxxxx. Queries 0700000000
Due today	Kiboko Credit: Your repayment of KES 3,750 is due today. Paybill 5xxxxx, Account 0712xxxxxx. Need more time? Call 0700000000
Overdue, day 3	Kiboko Credit: Your loan of KES 3,750 is 3 days overdue. Please pay or call 0700000000 to agree a plan. We are here to help.
Pre-listing notice	Kiboko Credit: Your loan of KES 3,750 is overdue. If unpaid by 30/01 we will report it to a licensed credit bureau. Call 0700000000
After listing	Kiboko Credit: On 02/02 we sent your loan information to a licensed credit bureau as notified on 31/12. To settle call 0700000000
Loan cleared	Kiboko Credit: Your loan is fully repaid. Thank you. Your updated status will be shared with the credit bureau.

Design notes:

Tone. Factual and helpful. "We are here to help" and an offer to agree a plan bring in more repayments than menace, and regulation 20 forbids threats and abusive language anyway.
Frequency. One reminder before the due date, one on the day and a small number after. Daily messages to a struggling borrower can amount to harassment under regulation 20(g).
Timing. Daytime only. The regulations set no hours, but a 2am reminder will feature in a complaint.
Receipts. Send one for every repayment, from the M-Pesa confirmation callback. See our Daraja C2B receipt tutorial.
No third parties. Messages go to the borrower's own number. A guarantor can be contacted only in the role they agreed to in the contract.

OTPs, offers and sender IDs

Lenders send three kinds of SMS, and they should not share one sender ID.

One-time codes for sign-up, login and loan acceptance. These must arrive in seconds. Our article on why OTPs fail in Kenya covers expiry times, resend rules and fallback.
Transactional messages: disbursement, receipts, reminders and bureau notices. On Safaricom these go on a transactional sender ID and are not time-restricted, according to Safaricom's 2020 notice.
Offers: top-up limits, new products, promotions to past borrowers. These are marketing: they need consent or a qualifying relationship, an opt-out (regulation 26(2) of the DCP Regulations, plus the Data Protection (General) Regulations, 2021), and on Safaricom a promotional sender ID used between 08:00 and 18:00.

Never put a loan offer inside a repayment reminder. It confuses the customer, makes the reminder marketing, and weakens your position if the message is ever examined in a complaint.

Automating it

eSMS Verify handles one-time codes end to end: it generates the code, sends it, rate-limits retries and checks the answer. Reminders and notices go out through the bulk endpoint with per-borrower variables, scheduled each morning from your loan book:

# 1. Confirm loan acceptance with a one-time code (eSMS Verify)
curl -X POST https://sms.esmsafrica.io/v1/verify/start \
  -H "Authorization: Bearer esms_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"to": "+254712000001", "app_id": "vera_your_app"}'

curl -X POST https://sms.esmsafrica.io/v1/verify/check \
  -H "Authorization: Bearer esms_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"verification_id": "ver_123", "code": "482913"}'

# 2. Send tomorrow's due-date reminders in one batch
curl -X POST https://sms.esmsafrica.io/api/messages/send-bulk \
  -H "Authorization: Bearer esms_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "sender_id": "KIBOKO",
    "text": "Kiboko Credit: Hi {{name}}, KES {{amount}} is due on {{due}}. Pay via M-Pesa Paybill 5xxxxx, Account {{acct}}. Queries 0700000000",
    "recipients": [
      {"to": "+254712000001", "name": "Mwangi", "vars": {"amount": "3,750", "due": "30/11", "acct": "0712000001"}}
    ]
  }'

Store the delivery report for every regulatory message, especially pre-listing and post-listing notices. If a borrower disputes that they were notified, the delivery report with timestamp is your evidence. Delivery reports arrive by webhook and in the dashboard. Test with an esms_test_... key first; test sends are simulated and free. See the HTTP API docs, the OTP for Kenya page and our OTP guide.

What it costs

SMS to Kenyan networks starts from KES 1.08 (about $0.0083) per message on the basic tier. Lenders with large books usually qualify for business (KES 0.9) or enterprise (KES 0.15) rates. There is no monthly minimum and no setup fee for the SMS API. Register both a transactional and a promotional sender ID in your licensed trading name; see the Kenya sender ID page.

Compliance checklist for lender SMS

Every message names the licensed lender; key messages say you are regulated by the CBK.
Reminders go only to the borrower, never to contacts read from the phone.
No threats, insults or shaming language in any template.
A receipt goes out for every repayment.
Pre-listing notice at least 30 days ahead (or the contractual period, minimum 7 days), and a post-listing notice within 30 days.
No negative listing at or below one thousand shillings outstanding.
Separate sender IDs for OTP and transactional messages and for offers.
Offers carry an opt-out, go only to consenting customers and respect the 08:00 to 18:00 window on Safaricom.
Your complaints channel appears in your terms and on your support messages.
Templates are approved, versioned and logged with delivery reports.

Frequently asked questions

Can a digital lender in Kenya send messages to a borrower's contacts?

No. Regulation 20 of the Digital Credit Providers Regulations, 2022 bars accessing a customer's phone book or contacts to message them about late payment, and bars unauthorised or unsolicited calls or messages to the customer's contacts. Contact only the borrower, plus any guarantor who agreed to that role in the loan contract.

Do we have to warn a borrower before listing them with a credit bureau?

Yes. Regulation 14(5) requires notice at least 30 days before submitting negative information, or a shorter period in the contract that is not less than 7 days. Regulation 14(3) bars negative listing where the outstanding amount does not exceed one thousand shillings.

Can we send loan offers to past borrowers?

Offers are marketing. Regulation 26(2) requires an opt-out from marketing messages, and the Data Protection Act and its 2021 regulations require consent or a qualifying relationship plus a simple, free opt-out. On Safaricom, offers go on a promotional sender ID between 08:00 and 18:00.

Is there a time-of-day limit for repayment reminders?

The regulations do not set hours for repayment reminders, and Safaricom treats transactional messages as unrestricted. Sending at night can still look like harassment, which regulation 20(g) prohibits, so keep reminders to daytime hours.

Sources

See how lenders, wallets and SACCOs use SMS on our mobile money and fintech SMS page for Kenya, compare with SACCO loan and deposit templates, and review pricing. Then create a free eSMS Africa account and test your reminder templates with a test key.