EXPOSED: CBK Fines 33 Banks Over Loan Pricing Breaches but Keeps Their Names Secret
By Milton Were The Central Bank of Kenya is facing legitimate questions over transparency after revealing that it penalised 33 commercial banks following targeted inspections into implementation of the Risk-Based Credit Pricing Model, yet failed to tell Kenyans which banks were punished or how much each institution was fined. The disclosure appears in CBK's Bank Supervision Annual Report 2025 , where the regulator states that it inspected commercial banks over implementation of the Risk-Based Credit Pricing Models rolled out in 2019. The results were striking: penalties were levied against 33 banks, administrative action was taken against another two, while only three banks were found to be fully compliant. This is not an insignificant regulatory matter involving one or two institutions. It means CBK found deficiencies serious enough to warrant penalties across most of the commercial banking sector. Yet the regulator chose to give the public numbers without names. A Kenyan borrower reading the report cannot establish whether the bank holding their mortgage, business loan, personal loan or asset-finance facility was among those penalised. That raises a straightforward question: why should CBK conceal the identities of financial institutions it has already determined should be penalised following a regulatory inspection? CBK itself acknowledges that monetary-policy decisions were not being transmitted uniformly or effectively into commercial-bank lending rates. Its annual report explains that changes in the Central Bank Rate were not uniformly or effectively reflected in lending rates, one of the problems that informed the reforms to Kenya's credit-pricing framework. The issue matters because borrowers have spent years questioning why reductions in the Central Bank Rate do not always translate quickly into significantly cheaper loans. CBK has repeatedly pushed banks to improve monetary-policy transmission, while the revised pricing framework is specifically designed to make the relationship between benchmark rates and what customers ultimately pay more transparent. The regulator's revised model now uses KESONIA as the principal benchmark for variable-rate loans, with CBR available as an alternative where KESONIA is impractical. Against that background, the decision not to identify the 33 penalised institutions becomes even more difficult for the public to understand. CBK is demanding transparency from banks when pricing loans, but its annual report provides considerably less transparency when disclosing the outcome of its own enforcement exercise. The regulator requires banks under the revised framework to publish their weighted average lending rates, weighted average premium and applicable fees and charges on their websites and the Total Cost of Credit website. CBK says these measures are intended to strengthen monetary-policy transmission, improve transparency in lending and promote responsible lending. If transparency is important enough to require banks to disclose how they price loans, there is a reasonable public-interest argument that enforcement outcomes should also be disclosed to the greatest extent permitted by law. Customers should be able to know whether their bank was found compliant or whether CBK found shortcomings serious enough to impose a penalty. The secrecy becomes even more puzzling because CBK did not only withhold the names of the 33 penalised banks. It also did not identify the two banks subjected to administrative action or the three banks it says were fully compliant . The result is an unusual regulatory disclosure. Kenyans know that 33 banks were penalised, but not which 33. They know that two banks faced administrative action, but not which two. They know three institutions passed CBK's inspection as fully compliant, but even those banks remain unidentified. The amounts involved in the penalties are another unanswered question. The annual report section announcing the sanctions does not provide a bank-by-bank breakdown showing the amount imposed on each institution. That prevents customers from assessing the seriousness of individual breaches or whether the penalties were substantial enough to provide a meaningful deterrent. CBK has considerably strengthened its enforcement framework. The Banking (Penalties) Regulations, 2025 established a standardised framework for assessing and imposing penalties against institutions and senior management for violations of the Banking Act. CBK itself says the framework is intended to strengthen accountability and promote compliance across the banking industry. Accountability, however, works best when the regulated institutions understand that regulatory failures have consequences and when the public receives enough information to understand how those consequences are being enforced. Publishing only an aggregate figure of sanctioned institutions provides considerably less accountability than identifying the institution, nature of the established violation, penalty imposed and corrective action required where disclosure is legally permitted. There may be legitimate statutory or supervisory-confidentiality considerations governing what information CBK can release from an inspection. Banking supervision necessarily involves commercially sensitive and confidential information that cannot simply be dumped into the public domain. But that makes it even more important for CBK to explain why the identities and sanctions were withheld , rather than leaving borrowers to speculate. Nobody is demanding publication of customers' confidential information, banks' proprietary data or every document obtained during regulatory inspections. The issue is considerably narrower: CBK has already publicly announced that it conducted inspections, established non-compliance and imposed penalties. The question is why the enforcement outcome cannot identify the institutions concerned. There is also a consumer-protection dimension. Banks compete aggressively for Kenyan borrowers. They advertise personal loans, mortgages, credit cards, business financing and asset finance while presenting themselves as trustworthy financial partners. Regulatory compliance can reasonably form part of the information customers consider when choosing between competing institutions. A customer comparing two banks should therefore have access to meaningful regulatory information where the law permits disclosure. If one institution was fully compliant with CBK's credit-pricing requirements while another was penalised after an inspection, that information may be relevant to the customer's decision. By withholding both names, CBK leaves the compliant institution and the penalised institution indistinguishable on this particular regulatory record. The Central Bank should consequently provide a clearer explanation. Kenyans deserve to know whether the identities are being withheld because of a specific statutory restriction, an established supervisory policy, pending processes or simply CBK's discretion. If disclosure is prohibited, the regulator should identify the legal basis. If it is discretionary, CBK should explain why secrecy outweighs the consumer and public interest in disclosure. CBK could also consider publishing a structured enforcement register containing, where legally permissible, the name of the institution, nature of the violation, relevant provision breached, penalty imposed, date of enforcement and status of corrective action . Such a system would allow consumers, investors and journalists to track regulatory enforcement without requiring disclosure of confidential supervisory material. The irony is difficult to miss. CBK's current reforms repeatedly emphasise transparency. The revised Risk-Based Credit Pricing Model requires banks to publish pricing information precisely because informed customers and transparent markets are supposed to produce better outcomes. The same principle deserves consideration when the regulator exercises its enforcement powers. CBK has told Kenyans that 33 banks were penalised, two faced administrative action and only three were fully compliant . ( Central Bank of Kenya ) Those are significant findings about institutions entrusted with Kenyans' deposits and responsible for trillions of shillings in lending. What CBK has not told Kenyans is arguably just as important. Which 33 banks were penalised? Which two faced administrative action? Which three complied fully? What did each institution do wrong? How much was each institution fined? Those questions do not attack the independence of the regulator. They test the transparency of regulation itself. CBK expects Kenya's banks to become more transparent with borrowers. It should explain why Kenyans cannot expect comparable transparency when CBK catches those banks breaking its rules.