Document text
BY E-MAIL AND THROUGH THE APP'S COMPLAINTS CHANNEL
Date: [DD/MM/YYYY]
From:
[YOUR FULL NAME]
ID No. [NATIONAL ID NUMBER]
Phone number registered with the app: [07XX XXX XXX]
[E-MAIL ADDRESS]
[POSTAL ADDRESS / TOWN]
To:
[REGISTERED COMPANY NAME OF THE LENDER], trading as [NAME OF THE APP]
Attn: Customer Complaints / Compliance Officer
[ADDRESS SHOWN IN THE APP OR ON THE LENDER'S WEBSITE]
[COMPLAINTS E-MAIL]
Copy: Central Bank of Kenya (to be sent if this complaint is not resolved)
Subject: Formal complaint under regulation 40 of the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026 — harassment in debt collection and contacting my phone contacts — loan account [LOAN NUMBER / REFERENCE]
Dear Sir/Madam,
1. I am your customer. On [DATE OF LOAN] I took a loan of KES [PRINCIPAL] through [NAME OF THE APP], loan reference [LOAN NUMBER]. The repayment date was [DUE DATE]. [I have repaid KES [AMOUNT PAID] so far. / The loan is overdue by [NUMBER] days.] I do not dispute that I owe [AMOUNT I ACCEPT / "the balance properly due under the loan agreement"].
2. This complaint is not about whether I owe money. It is about how you and/or your agents are collecting it. Since [DATE], your staff or collectors have done the following:
# Date and time Phone number or account used Sent to (me / name of contact) What was said or sent Evidence
1 [DD/MM/YYYY, HH:MM] [NUMBER] [ME / CONTACT'S NAME AND RELATIONSHIP] [E.G. "THREATENED TO POST MY PHOTO AS A THIEF"] [SCREENSHOT 1]
2 [DD/MM/YYYY, HH:MM] [NUMBER] [MY EMPLOYER / RELATIVE / FRIEND] [E.G. "TOLD MY EMPLOYER I AM A DEFAULTER"] [SCREENSHOT 2 / CALL LOG]
3 [DD/MM/YYYY, HH:MM] [NUMBER] [ME] [E.G. "INSULTS / OBSCENE LANGUAGE"] [RECORDING / SCREENSHOT 3]
4 [DD/MM/YYYY, HH:MM — E.G. 22:40] [NUMBER] [ME / CONTACT] [E.G. "CALL LATE AT NIGHT"] [CALL LOG]
[ADD OR DELETE ROWS. KEEP THE ORIGINAL SCREENSHOTS AND CALL LOGS.]
3. This conduct is prohibited. Regulation 30(1) of the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026 (Legal Notice 191 of 2026) forbids a credit provider, its employees and its outsourced service providers, in the course of debt collection, from:
a) using threats to harm a person, his reputation or property (reg. 30(1)(a));
b) sending obscene or profane language to a customer or to the customer's references or contacts to shame him (reg. 30(1)(b));
c) accessing a customer's phone book or contacts list to send them messages about late payment or non-payment (reg. 30(1)(c));
d) posting a customer's personal information online or on any other forum to shame him (reg. 30(1)(d));
e) making unauthorised or unsolicited calls or messages to a customer's contacts (reg. 30(1)(e));
f) any conduct whose consequence is to harass or oppress a customer, and abusing any person in connection with the collection of a debt (reg. 30(1)(g) and (h));
g) calling a borrower or any other person outside working hours (reg. 30(1)(i)).
Regulation 41(1)(a) further prohibits threatening, intimidating, abusing or humiliating a customer, and regulation 32(2) prohibits sharing my information with any other person without my express consent, except as required or permitted by law. These Regulations apply to you: lenders licensed under the Digital Credit Providers Regulations, 2022 are deemed licensed under the 2026 Regulations (reg. 96(4)).
4. My personal data. My contacts' details were not given to you so that you could shame me before them. Under section 26 of the Data Protection Act (Cap. 411C) I have the right to object to the processing of my personal data, and under section 40(1)(b) I may require you to erase personal data that you are no longer authorised to retain, that is irrelevant or excessive, or that was obtained unlawfully. I withdraw any consent I may have given for you to access or use my phone contacts, call logs or photos, and I object to their use for debt collection.
5. I therefore require you to:
a) stop immediately all calls and messages to my contacts, my employer and any third party, and all threats, insults and calls outside working hours;
b) acknowledge this complaint within seven days of receipt (reg. 40(3)) and resolve it within thirty days (reg. 40(5)), in writing;
c) give me the name and contacts of every person or company collecting this debt for you (reg. 44);
d) send me a full loan statement showing principal, interest, every charge, every payment I made and the balance (reg. 39(1)(d)), and confirm that you are not recovering any charge that was not disclosed in the loan agreement (reg. 30(2)) or any interest above the limit in regulation 29;
e) erase my contacts list, call logs and any other data copied from my phone that you hold, confirm in writing that this was done and name every third party you shared it with (Data Protection Act, s.40; Data Protection (General) Regulations, 2021, reg. 12(3): response within fourteen days);
f) not submit negative information about me to a credit reference bureau while this complaint is pending, and in any case not without the written notice required by regulation 33(6) of the 2026 Regulations.
6. I am willing to settle the balance properly due. My proposal is: [E.G. "KES [AMOUNT] PER [WEEK / MONTH] FROM [DATE]" / "PAYMENT IN FULL ON [DATE] AGAINST A STATEMENT"]. Please communicate with me only through [E-MAIL / THIS PHONE NUMBER], between [08:00] and [17:00].
7. If this complaint is not resolved within thirty days, I will lodge a complaint with the Central Bank of Kenya under regulation 50(3) of the 2026 Regulations and with the Office of the Data Protection Commissioner under section 56 of the Data Protection Act, and I will report threats to the police. I reserve all my other rights, including a claim for damages.
Yours faithfully,
______________________________
[YOUR FULL NAME]
Attachments (copies):
1. Loan confirmation SMS / screenshot of the loan in the app ([DATE])
2. Screenshots of messages and call logs listed in the table (numbered 1 to [N])
3. Screenshots or written statements from contacts who were called ([NAMES])
4. M-Pesa or bank statements of repayments made
NOTES BEFORE SENDING — delete this part
Complain to the lender first. The 2026 Regulations say a customer shall first lodge the complaint with the credit provider and may then go to the Central Bank of Kenya if it is not resolved (reg. 50(2)–(3)). Keep proof that you sent this letter: the e-mail, a screenshot of the in-app ticket, or a courier receipt.
Dates to watch: acknowledgement within 7 days of receipt, resolution within 30 days of reporting (reg. 40(3) and (5)). A complaint made by phone that is not resolved in 48 hours must be confirmed to you in writing (reg. 40(4)).
Who these rules cover: non-deposit taking credit providers, including digital loan apps. They do not cover banks, microfinance banks or Saccos (reg. 3(3)). If the loan came from a bank product (for example a mobile overdraft run by a bank), address the complaint to the bank and use the bank's complaints process.
Unlicensed app? Check the Central Bank of Kenya's published list of licensed and registered credit providers. If the app is not on it, say so in your complaint to the CBK.
Data complaint: you can complain to the Data Commissioner free of charge, in writing, by e-mail or online; the Commissioner must acknowledge it within 7 days (Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021, reg. 4) and investigate and conclude it within 90 days (Data Protection Act, s.56(5)).
Threats of violence are a police matter. Report them at the nearest police station and keep the OB number.
Do not use insulting language yourself — keep the letter factual.
Field labels in [SQUARE BRACKETS, CAPITALS] must be completed or deleted. Alternatives are separated by a slash. © Layers (layers.md), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Template, not legal advice.
Reply to this document or get a deadline reminder: https://layers.md/ke/loan-app-harassment-complaint-letter?from=reply-ke-loan-app-harassment