Government & Regulatory Affairs in Kenya

Essentials guide · Source-checked research43% of statements checked against a source12 checked against an official source14 checked against a secondary sourceChecked 2026-10-1911 held back until checked against an official source10 topics include AI-written statements, not source-checkedNot yet professionally reviewed

• Kenyan law does not impose a general cap on foreign ownership of companies, but sector laws set local ownership requirements in some regulated industries.

  Examples are understood to include insurance, telecommunications and some mining and security activities; check the sector law.AI-written, not source-checked

• Foreign investors may apply to the Kenya Investment Authority for an investment certificate, which is optional and is linked to a minimum investment amount.

  Investment Promotion Act. Not required to trade.AI-written, not source-checked

• Export processing zone enterprises pay corporate income tax at 0% for the first ten years and 25% for the next ten, and special economic zone enterprises, developers and operators pay 10% for the first ten years and 15% for the next ten.

  Supplies of goods or taxable services to special economic zone enterprises are zero-rated for VAT (PwC, Kenya - Corporate - Other taxes). Conditions apply.PwC Worldwide Tax Summaries · checked 2026-10-19

• Public procurement is governed by the Public Procurement and Asset Disposal Act 2015, which includes preferences and reservations for local and disadvantaged suppliers.

  Applies to national and county government entities.AI-written, not source-checked

• Many regulated imports require a certificate of conformity under the Kenya Bureau of Standards' Pre-Export Verification of Conformity programme before shipment.

  Applies to products on the regulated list.AI-written, not source-checked

• Data controllers and data processors that process personal data of people in Kenya must register with the Office of the Data Protection Commissioner unless they have annual turnover below KES 5 million and fewer than 10 employees and are outside the sectors listed for mandatory registration.

  Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021, in effect from 14 July 2022. Sectors registering regardless of size include education, health, hospitality, property management, financial services, telecommunications, direct marketing and transport. Certificates are valid for two years.Office of the Data Protection Commissioner (Kenya) · checked 2026-10-19

• Mergers that meet thresholds under the Competition Act 2010 must be notified to and approved by the Competition Authority of Kenya before implementation.

  Notification depends on the parties' combined turnover or assets in Kenya under Competition Authority guidelines; law-firm summaries describe the bands differently, so confirm the current guidelines. Implementing without approval is an offence (up to five years' imprisonment, a fine of up to KES 10 million or both) and can attract a penalty of up to 10% of the preceding year's Kenyan turnover.Cliffe Dekker Hofmeyr · checked 2026-10-19

• Mergers where the parties operate in at least two COMESA member states and meet the COMESA thresholds must be notified to the COMESA Competition Commission.

  The source gives thresholds of combined COMESA turnover or assets of at least USD 50 million, with at least two parties each having at least USD 10 million, and an exception where each party earns two-thirds of its COMESA turnover or assets in one member state.CM Advocates LLP · checked 2026-10-19

Read the full guide: Entry, investment and company formation · Licensing, incentives and sector rules · Customs, trade and supply chain · M&A, competition and restructuring