Kenya CMA Market Certification and CPD: What Intermediaries Must Do

Kenya replaced the rulebook that licenses its capital markets intermediaries in December 2025, and the new one is almost silent on staff competence. That is not an oversight. The training, certification and CPD obligations that apply to the people inside a licensed Kenyan firm have never lived in the licensing regulations. They sit in a 2011 corporate governance instrument, and in guidance issued under a single subregulation of it.

This guide sets out what each instrument actually requires, which parts are firmly established, and which are not, as at October 2026.

What the 2025 Licensing Regulations do and do not say

The Capital Markets (Licensing Requirements) (General) Regulations, 2025 were published as Legal Notice 197 of 2025, dated 11 December 2025. Regulation 59 revokes the predecessor Capital Markets (Licensing Requirements) (General) Regulations outright, so any internal procedure still citing the old instrument is citing a revoked one.

Regulation 58 handles the transition. Licences already approved and issued when the Regulations took effect continue in force until revoked, but where the new Regulations impose additional requirements, licensed persons have twelve months from commencement to meet them. Anyone operating an over-the-counter platform or an intermediary service platform must apply to the Authority within one year.

On people, the 2025 Regulations are a fitness instrument rather than a training instrument. Regulation 56 requires every person who is, or is to be, a director, chief executive officer or other key personnel relevant to the business of a market intermediary to be fit and proper for the particular position held. In deciding that, the Authority has regard to the person's probity, competence and soundness of judgment in fulfilling the responsibilities of the position, the diligence with which they are fulfilling or likely to fulfil them, and whether clients' interests are threatened by their holding it.

Specific experience thresholds appear in a few places. A chief executive officer of a securities exchange must have at least ten years' experience at senior management level, with expertise in capital markets or other disciplines relevant to the exchange's functions. Representatives of an applicant for an investment adviser licence must have at least three years' experience advising on financial products, securities, funds, assets or portfolios, and must be members of a professional body. Licence applications across several categories must include a statement on the qualifications, experience and expertise of the chief executive officer and key staff, and on the proposed management and qualifications of key personnel.

What the 2025 Regulations do not contain is a CPD requirement, a mandatory examination, an examination syllabus or an individual certification scheme. Searching the instrument for continuing professional development, CPD or examination returns nothing at all. Firms that expected the December 2025 rewrite to consolidate the competence regime into one place did not get it.

Where the staff obligations actually sit

The operative instrument is the Capital Markets (Corporate Governance) (Market Intermediaries) Regulations, Legal Notice 144 of 2011, whose latest consolidated version on Kenya Law carries the date 31 December 2022. It was untouched by the 2025 licensing rewrite and remains the current law.

Directors: governance training within six months

Regulation 4 prevents a market intermediary from appointing a person as a director unless that person is fit and proper to hold the position and has undergone relevant training on corporate governance. A proviso inserted by Legal Notice 115 of 2013 softens the sequencing: the firm must ensure that any person appointed as a director undergoes corporate governance training within six months of appointment. The deadline runs from the appointment, not from the end of a financial year, so a board that appoints mid-year cannot park the obligation until an annual training cycle comes round.

Employees: three obligations in one regulation

Regulation 19 carries most of the weight, in three short subregulations.

• The board must ensure that all employees are fit and proper for their roles, including having the necessary qualifications and experience for their responsibilities, with no evidence of a lack of integrity or other matters raising concerns about their probity or their capacity to manage their own or clients' financial affairs.
• Management must determine and document the experience and qualifications for each post, and meet any relevant requirements of the Authority.
• Management must ensure that all employees have, and document, an appropriate training programme based on the needs of the market intermediary and the requirements of the Authority.

Two features of this are easy to miss. The documentation duty attaches to the post, not only to the person, so a firm is expected to be able to show what a role requires before showing that its holder meets it. And the phrase "requirements of the Authority" is the hook on which the CMA's certification and CPD regime hangs. The numbers are not in the Regulations at all.

Finance and internal audit: a named professional body

Regulation 21 requires the chief finance officer, or whoever else is responsible for the finance department, and the person responsible for the internal audit function, to be members of the Institute of Certified Public Accountants of Kenya. This is one of the few places where Kenyan capital markets rules name a specific body rather than describing a standard.

The compliance officer, and personal liability

Regulation 30 requires the board to appoint a compliance officer who monitors compliance with the Authority's regulatory requirements, is not involved in any function subject to that compliance, has sufficient authority, unfettered access to information and direct access to the board, rectifies non-compliance, escalates what cannot be rectified, reports material breaches, and submits an annual corporate governance report to the board. The second subregulation is the one that concentrates minds: the officer in charge of compliance may be held personally liable for the firm's failure to comply with the Authority's requirements.

What can be waived, and what cannot

Regulation 36 lets the Authority, on written application and in the special circumstances of a firm, exempt it from or vary the application of regulations 13, 15(5), 18, 21, 22, 23, 24(6) and 30, for a stated period. Regulation 4, regulation 19 and the record-keeping regulations are not on that list. Director governance training, employee fitness and the documented training programme are not available to be waived. A firm must also keep complying while an application is pending, until the Authority confirms an exemption or variation in writing.

The CPD regime: 35 hours a year

The CMA's Capital Markets Continuous Professional Development (CPD) Policy Guidelines for Kenya set the numbers. They cite regulation 19(3) of the 2011 Regulations, together with a November 2015 circular on Market Certification and Competency Standards, as their basis.

The population covered is defined as target employees: all employees of a market intermediary licensed under Part IV of the Capital Markets Act who have direct dealings with clients or carry out trading activities on their behalf, and those who influence or advise clients either directly or indirectly. That is a function test, not a job-title test. An operations, research or product role that shapes client advice can fall inside it, while an exercise that matches titles against a list would miss it.

The requirement itself is three numbers:

• 35 hours of CPD within a year
• a minimum of 24 hours of structured CPD
• a maximum of 11 hours of unstructured CPD

Structured CPD is an activity undertaken for the express purpose of learning. Unstructured CPD covers unplanned activity with no predetermined learning objective or outcome. Delivery runs through providers accredited by the Authority, which the Guidelines limit to reputable institutions able to demonstrate quality content, sustainability and administrative capability.

Accredited providers must record hours in a verifiable manner, and must cover a set of mandatory modules: anti-money laundering; financial technology and related risks such as cybercrime; integrity and ethics; corporate governance and the stewardship code; introduction to derivatives in Kenya; know your client and client suitability; collective investment schemes including REITs; and risk, together with current updates on policies, regulations and services in Kenya's capital markets. A firm scoping a provider should be checking that list line by line rather than accepting a general financial services curriculum.

What does not count

The Guidelines are unusually explicit about exclusions. Appraisals, one-to-one meetings and performance reviews do not count. Nor do activities with no identifiable or recordable learning outcome, activities not relevant to the current or evolving role, subjects unrelated to financial services, normal day-to-day job activities, or social and networking events. Lunch and tea breaks are not to be included in the hours.

The evidence rules matter as much as the hours. Each record must show the title of the activity, the person's name and surname, the date or date range, the duration, a score or grade where applicable, and specific confirmation of attendance or participation after the activity has taken place. Invoices or proof of payment, calendar entries, screenshots of CPD systems, replies confirming an intention to attend, event programmes, slides and notes, and certificates without the attendee's full name are all listed as unacceptable evidence. A great deal of what firms habitually file as training evidence appears on that list.

Records, and the consequence of falling short

Licensed firms must maintain, or cause to be maintained, records of all structured and unstructured CPD in a form verifiable by the Authority during supervisory visits. Providers must be able to audit logged hours and make records available for CMA audit.

That sits alongside regulation 34 of the 2011 Regulations, which requires employee records demonstrating that the firm has effectively assessed qualification, experience, fitness and propriety, and specifies their contents: the job application with documentation verifying qualifications and experience, the job description, qualifications, experience and training, remuneration, any securities transaction with details of the permission received, any declaration of an existing or potential conflict of interest, and details of all publicly traded listed securities owned. Regulation 33 requires board records of decisions and of actions taken to comply with the Authority's requirements, and regulation 35 extends record-keeping to functions contracted out to a third party.

The sanction for missing CPD is not a fine. Under the Guidelines, a target employee who fails to meet the requirement is suspended from any involvement in prescribed aspects of the licensed firm's business, and remains suspended until the requirement is met. For a client-facing desk that is a capacity problem, not a paperwork problem.

Certification: the CISI route

Certification is separate from CPD, and it came first. The CMA's programme documentation describes a memorandum of understanding signed with the Chartered Institute for Securities and Investment in September 2014, a launch to the market in April 2016, and compliance with the programme from 4 January 2017. Two steps are described: an International Introduction to Securities and Investment (Kenya) examination of 60 multiple-choice questions in 75 minutes at a 70 per cent pass mark, and a Regulations and Practice (Kenya) examination of 50 questions in 60 minutes at the same pass mark. Successful candidates may use the ACSI designatory letters. Training through an accredited training partner is advised rather than required.

Grandfathering applied: practitioners with more than ten years' experience were exempted from certification from January 2017. Critically, the CPD Guidelines state that target employees who were grandfathered or exempted from certification are still required to complete the annual CPD hours to maintain their dealing-with-clients status. Exemption from the examination is not exemption from CPD, and a firm that treats a long-serving desk as outside the regime has misread it.

Three things that are not settled

The CPD Policy Guidelines carry no printed issue date or version number, and the latest dated item inside them is from January 2018. The CMA has since published two circulars titled Market Certification and Competency Standards, numbered 1 and 2 of 2019. Those circulars could not be read as text when this guide was written, they may revise the standards described here, and they should be read directly from the CMA before a firm fixes its hours or its provider list.

The second examination's syllabus appears in the programme documentation under a proposed label, so the current status of that paper is worth confirming with the Authority rather than assuming.

And the governance instrument itself is under review. The CMA issued draft Capital Markets (Corporate Governance) (Market Intermediaries) Regulations 2025 for stakeholder and public feedback, with comments invited by 22 May 2025. The 2011 Regulations remain the latest version published on Kenya Law, so the draft has not displaced them. But regulation 19(3) is the foundation the entire CPD regime rests on, and a rewrite of it would move the ground under everything above.

How Kenya's design compares

Kenya's structure — a fitness and propriety test in the licensing rules, a documented training-programme duty in the governance rules, and the actual numbers in guidance beneath both — is a recognisable African and Gulf pattern. Nigeria's approved persons regime puts the experience ladder and the remedial training obligation in a framework sitting under the central bank's rules, while South Africa's FSCA ties class-of-business training and CPD to a fit-and-proper determination with a competence register behind it. Bahrain's Central Bank takes the opposite approach and writes the hours into a rulebook module itself. The practical consequence for a group operating across these markets is that a single competence matrix will not satisfy all of them, because the obligation attaches at a different level in each.

A working checklist for a Kenyan intermediary

• Confirm every director has completed corporate governance training, and that anyone appointed in the last six months is inside the regulation 4 window.
• Produce a documented qualification and experience specification for each post, not only for each person.
• Identify target employees by function against the Guidelines' definition, including roles that influence advice indirectly.
• Check the 35, 24 and 11 hour figures per person per year, and confirm the provider is CMA-accredited and covers all eight mandatory modules.
• Audit the evidence you hold against the unacceptable list. Certificates without full names, calendar entries and payment receipts will not survive a supervisory visit.
• Confirm that grandfathered and exempted staff are inside the CPD population.
• Read circulars 1 and 2 of 2019 directly, and confirm whether the second examination is live.
• Replace any citation of the revoked licensing regulations with Legal Notice 197 of 2025.

The regime rewards firms that treat competence as a records discipline rather than a training spend. Nothing in the Kenyan rules asks a firm to buy a particular course. What they ask for, repeatedly, is documentation that a role was specified, that a person was assessed against it, and that learning was recorded in a form a supervisor can verify.