What’s Illegal in 2025?
Kenya’s business environment in 2025 is governed by stricter laws and heightened regulatory enforcement. From financial fraud to data misuse, authorities have intensified crackdowns on practices that exploit consumers, distort markets, or pose systemic risks. This guide outlines the key business activities that are banned or heavily restricted under current law, including pyramid schemes, unlicensed forex trading, and data privacy violations.
1. Pyramid Schemes and Unlicensed Investment Clubs
Pyramid schemes remain illegal under the Capital Markets Act, Consumer Protection Act, and Penal Code. These schemes typically promise high returns for recruiting others, rather than selling legitimate products or services.
Key Characteristics
- Paid recruitment with no tangible product
- Promises of unusually high returns with little risk
- Pressure to recruit new members to earn commissions
- Lack of regulatory licensing or physical presence
Enforcement Actions
- In August 2020, regulators including CBK, CMA, SASRA, and RBA issued a joint warning against schemes like Crowd1
- In 2023–2024, CMA investigated over 500 unregulated products, including pyramid-style crypto and real estate schemes
- Promoters face fines, asset seizures, and criminal prosecution
2. Unlicensed Forex Trading and Online Brokers
Online forex trading is legal only when conducted through licensed brokers regulated by the Capital Markets Authority (CMA) and the Central Bank of Kenya (CBK).
What’s Illegal
- Operating as a forex broker without CMA or CBK license
- Soliciting funds from the public for currency trading without disclosure
- Promising guaranteed returns or using fake endorsements
Recent Crackdowns
- CMA shut down Interweb Global Fortune Ltd and Thika Forex Trading Lounge for illegal operations
- In 2023, CMA ordered refunds and filed criminal charges against multiple unlicensed forex dealers
- Licensed brokers must now display client loss ratios on their websites to warn investors
3. Data Privacy Violations
The Data Protection Act (2019) prohibits unauthorized collection, processing, or sharing of personal data. Businesses must register with the Office of the Data Protection Commissioner (ODPC) and comply with strict handling protocols.
Common Violations
- Collecting customer data without consent
- Sharing or selling data to third parties without disclosure
- Failing to secure databases against breaches
- Using biometric data without legal basis
Penalties
- Fines up to KSh 5 million or 1% of annual turnover
- Suspension of business operations
- Civil suits from affected individuals
4. Other Banned or Restricted Practices
| Practice | Legal Status | Regulatory Body |
|---|---|---|
| Unlicensed SACCO operations | Illegal | SASRA |
| Unregistered mobile loan apps | Banned from app stores | CBK, CAK |
| Fake investment platforms | Criminal offense | CMA, DCI |
| Unlicensed money remittance | Prohibited | CBK |
| Misleading advertising | Restricted | CAK |
| Sale of counterfeit goods | Criminal offense | ACA, KEBS |
Final Thoughts
Kenya’s 2025 regulatory landscape is designed to protect consumers, stabilize financial markets, and promote ethical business conduct. Entrepreneurs and investors must ensure full compliance with licensing, data protection, and consumer rights laws—or risk fines, shutdowns, and legal action.
