Calling hours, wording and third parties: collection conduct under Kenyan rules

Collections is regulated work, and anyone who has run a team knows it. Which rules bind you exactly depends on how your institution is licensed. The baseline, though, is public and fairly plain. You don't threaten people. You don't shame them. And you don't lean on them through their family, their employer or the contacts in their phone.

In this post we go through the official rules you can point a team to, and then the controls in CadenceApp's Kenya Compliance Pack. Please read it as a product and orientation piece, not legal advice. Your lawyer, your regulator and your own policy have the final word.

We're a digital credit provider. What applies to us?

The Central Bank of Kenya has published the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022, Legal Notice No. 46 of 2022. You can check who is licensed in CBK's directory of digital credit providers.

Debt collection is covered in regulation 20. Put briefly, it bars a digital credit provider, along with its officers, employees and agents, from conduct such as:

• threatening violence or other harm to a person, their reputation or their property
• sending obscene or profane language to a customer, or to the customer's references or contacts, to shame them
• using the customer's phone book or other phone records to message their contacts about late payment
• posting the customer's personal information online or elsewhere to shame them
• making unauthorised or unsolicited calls or messages to the customer's contacts
• any other improper debt collection tactic, or conduct meant to harass, oppress or abuse

If you hold a DCP licence, those rules apply to you whichever software you use. We've kept the summary short on purpose, so do read the full legal notice rather than leaning on our version.

And if we're a bank, an MFI or a SACCO?

Regulation 2 of the same notice says the DCP Regulations don't apply to institutions already licensed under other laws, such as banks, microfinance institutions and SACCO societies.

That's not a free pass. It means you follow the law, prudential guidelines and internal policy that do apply to you. Copying a DCP checklist and assuming it covers a SACCO, or the other way round, is how gaps open up.

CadenceApp comes with starter setups for lenders, for SACCOs and MFIs, and for BPOs and collection agencies. The software doesn't decide which rules you're under. Your compliance people do.

Every call list is full of personal data

Think about what's in a collections file: names, phone numbers, ID numbers, balances, employer details, next-of-kin fields. Kenya's Data Protection Act, 2019 sets principles for processing that's lawful, fair and transparent. It ties data to the purpose it was collected for, gives people rights over their data, restricts direct marketing and puts duties on you when there's a breach.

The Office of the Data Protection Commissioner (ODPC) registers data controllers and processors and handles complaints. Whether your organisation has to register, and how you deal with a complaint or a breach, are questions for your own compliance team.

If you want to look around, start a free 30-day trial or contact the team. Current plan details are on the live pricing page. We don't quote prices here.

What does the Compliance Pack actually do?

The Kenya Compliance Pack is a paid add-on, priced separately from the seat plans. You can open the Compliance screens and look before you buy, but the checks only start running once the pack is active for your organisation.

Here's how a supervisor would typically set it up. First you enter the calling hours your organisation allows, and from then on calls outside those hours are blocked. Then you look at the wording check. Outgoing messages are checked against a built-in list of threatening or shaming phrases, plus any you add yourself, and a message that matches is stopped before it goes.

Next come third parties. Where you've flagged a number as a borrower's third-party contact (family, a friend, an employer), calls and messages to that number are blocked. Finally, there are two logs, one for consent and one for breaches. The breach log shows how long it has been since a breach was found, which helps you keep track of your ODPC notification duty.

Underneath all this sits the audit trail. Each entry records who made a change, their role, their IP address, the time, and what changed, before and after. Nobody can edit or delete an entry, and each one is chained to the previous one with a hash, so tampering can be detected. You can export the trail to PDF or Excel with your organisation's branding. Each organisation's data is kept separate from every other organisation's.

We need to be straight with you about the limits. These tools help you follow your rules. On their own they don't make your business compliant, and they aren't a certification. The Compliance screen tells you the same thing and asks you to have a lawyer review your collection process and settings.

Supervisors can also listen in on a live call, whisper to the agent or join it, where your organisation's phone system supports that. Not every voice provider does, so check your setup before you write it into a policy.

How would I brief my team on this?

Without turning it into a pressure script, start by agreeing the hours your institution may call, and set those in the product. Flag the third-party numbers, so nobody is tempted to use them as a shortcut.

After that, keep your team on the approved SMS, WhatsApp and email templates, with a tone that stays inside your policy. Promises and outcomes belong on the account, the way we describe in Stop losing promises to pay, not in someone's private chat. And know your complaints process before a borrower asks you about it.

What compliance leads usually ask

If we switch on the Compliance Pack, are we compliant? No. It enforces the hours, wording lists, third-party flags and logs that you set up. Your lawyer, your regulator and your policy still have the final say.

Do the CBK DCP rules cover a SACCO? Not those particular regulations. Regulation 2 carves out institutions licensed under other laws. A SACCO still has its own legal and policy duties, though.

When do the calling-hour blocks kick in? Once the Kenya Compliance Pack is active for your organisation and you've set the hours. You can look at the Compliance screens before you buy it.

Is this legal advice? It isn't. Read the legal notice and the Data Protection Act, 2019 yourself, and get advice that fits your licence.

CadenceApp is free to try for 30 days, and you won't need a card. Start at cadenceapp.co.ke/en/register.