“RWANDA IS OPEN” TO “KENYA IS READY”

A Business Guide by Mukamba & Company Advocates, Nairobi

“Rwanda is open for business” has been the country’s pitch to founders for years, and it has largely delivered: fast registration, low corruption, and a government that shows up to help.

But a slogan about being open doesn’t answer a question every scaling founder eventually asks: open for whom to buy what I’m selling?

That’s a market question, not a registration question, and increasingly the honest answer points to Kenya.

This is why a specific pattern has become common among Rwandan-founded tech companies: keep the company that was built in Rwanda, and incorporate a second one in Kenya, not because Rwanda stopped working, but because “ready” and “open” are different things, and a growing company eventually needs both.

What ‘Ready’ Actually Means Here

Kenya raised approximately USD 638 million in tech start-up funding in 2024, close to 30% of everything raised across the African continent that year.

That is the capital base a fintech, healthtech, or B2B SaaS company is trying to reach when it talks about being “investor-ready,” and much of that capital is deployed by investors with a Nairobi presence who want a Kenyan entity, or at least Kenyan operating substance, before they write a cheque.

“Ready” also means regulatory readiness. Kenya’s Data Protection Act, Cap 411C, closely mirrors the EU’s GDPR in structure, and the Office of the Data Protection Commissioner has moved from issuing guidance to issuing enforceable fines that have held up on review.

For a startup handling personal data at scale, being able to demonstrate compliance with a GDPR-aligned framework is now a genuine commercial advantage when courting international enterprise clients or investors.

The Legal Position

Kenyan incorporation is governed by the Companies Act, No. 17 of 2015, administered by the Business Registration Service through the eCitizen platform.

A Rwandan founder can incorporate a Kenyan private limited company with a single director and shareholder, either of whom may be the Rwandan founder personally or the existing Rwandan company acting as shareholder.

For a fintech specifically, incorporation is only the first licence to think about.

Digital payment activity in Kenya is regulated by the Central Bank of Kenya under the National Payment System Act, 2011, and the associated PSP authorisation framework, while investment-related products fall under the Capital Markets Authority, which operates a regulatory sandbox for testing innovative financial products before full licensing.

A healthtech or investment product may need to engage both CBK and CMA, or the Insurance Regulatory Authority, depending on what it actually does.

Two Ways to Structure the Move

Data Protection: The Detail Founders Miss

Kenya’s Data Protection Act requires data controllers and processors to register with the ODPC, and imposes obligations on cross-border data transfers that matter directly to any startup whose infrastructure or team spans Rwanda and Kenya.

A company moving user data between a Kigali-based engineering team and a Nairobi-based commercial entity needs a documented lawful basis for that transfer, not an assumption that shared ownership makes it automatic.

The Office of the Data Protection Commissioner has shown it is willing to pursue enforcement with real financial consequences, so this is not a box-ticking exercise; it is now treated the way GDPR compliance is treated in Europe.

Common Mistakes

A Practical Example

A Kigali-based digital lending startup, already operating under Rwanda’s regulatory framework, wants to extend its product into Kenya.

Rather than trying to serve Kenyan customers directly from Rwanda, it incorporates a Kenyan subsidiary, registers as a data controller with the ODPC, and engages the Central Bank of Kenya on the payment-system requirements applicable to its product.

The Rwandan parent retains the core lending technology and continues serving the Rwandan market; the Kenyan entity becomes the licensed, locally compliant vehicle for Kenyan customers and investors.

Frequently Asked Questions

Does my Rwandan fintech licence carry over into Kenya?

No. Kenyan payment, lending, and investment activities are separately regulated by the CBK, CMA, or IRA depending on the product, regardless of any Rwandan authorisation.

Do I need to register as a data controller before I have Kenyan customers?

Registration obligations under the Data Protection Act apply based on the nature and scale of processing, and this should be assessed for your specific product rather than assumed either way.

Can my existing Rwandan company just open a branch in Kenya instead?

Yes, that is legally possible under Part XXXVII of the Companies Act, 2015, though most tech founders find a standalone Kenyan subsidiary cleaner for investor and regulatory purposes.

Why Work With Mukamba & Company Advocates

We advise Rwandan and other regional tech founders on structuring their Kenyan entry, from incorporation through data protection registration and the relevant CBK, CMA, or IRA engagement for regulated products.

Getting this sequence right before you have Kenyan customers is materially cheaper than fixing it after a regulator or investor flags a gap.

Final Thoughts

Rwanda’s pitch was always about being open, and it has been. Kenya’s pitch is different: it’s about being ready, for capital, for regulated products, and for a data protection regime that increasingly gets treated as seriously as Europe’s.

Tech founders incorporating across the border aren’t rejecting Rwanda’s openness; they’re adding Kenya’s readiness on top of it.

The information in this article is for general information purposes only and does not constitute legal advice for any individual case. It does not create an attorney-client relationship. For advice specific to your situation, contact Mukamba & Company Advocates directly.