By 
By Fintech Association of Kenya
Eight words on the first page of Kenya’s current telecommunications market structure change the legal identity of the infrastructure beneath the country’s cloud economy:
> “Data Centres will be licensed under this category.”
The category is the Network Facilities Provider Tier 2 licence, or NFP-T2. It was designed for entities that deploy communications infrastructure countrywide. Under the fee schedule published by the Communications Authority of Kenya and the detailed licence terms, a new commercial data-centre operator pays a KSh5,000 application fee, KSh15 million for a 15-year licence and an upfront prorated operating fee stated as KSh800,000. In subsequent years, the operating fee is 0.4% of audited annual gross revenue accruing from the licensed systems or KSh800,000, whichever is higher.
RELATED: Kenya’s Revised Telecommunications Market Structure – formal recognition of data centres as a regulated activity
An operator that already holds an NFP-T1 or NFP-T2 licence may establish a commercial data centre without obtaining another licence.
This is not the proposal Kenya debated in 2024 and 2025. Gazette Notice No. 3335 dated 17 February and published in the Kenya Gazette on 6 March 2026, said the revised structure would take effect 30 days from the date of the notice. The Authority now describes the framework as having been established in April 2026 and subsequently published a consolidated schedule and detailed licence terms in June and July.
The obvious interpretation is regulatory maturity. Data centres concentrate computing, electricity, connectivity and customer workloads. Their failure can interrupt banks, public services, retailers and digital platforms at once. Bringing commercial facilities into formal oversight can create clearer duties for resilience, physical access, service continuity and fair dealing.
But Kenya did more than decide that data centers should be supervised. It placed them inside a license whose principal scope is countrywide communications infrastructure.
That choice raises two questions the headline fee cannot answer. Does the NFP-T2 rulebook fit a facility that sells space, power and cooling but does not operate a public communications network? And when the annual charge is calculated, does reimbursed electricity count as revenue from the licensed system?
The first determines what the Authority is regulating. The second determines what operators and, potentially, their customers will pay.
Part I · The Line That Moved.
Until 2026, Kenya’s Unified Licensing Framework did not expressly classify commercial data-centre operators, although the National ICT Policy published in 2020 had already said the Government would promote, encourage and license private investment in neutral data centres.
The Authority’s December 2024 consultation paper proposed two routes. A data centre that established terrestrial or satellite connectivity to its facility would require NFP-T3. One providing the building, power, servers and internal infrastructure without public-space communications infrastructure would require an application service provider license.
Operators objected that neither category accurately described pure colocation. An ASP licence was designed for electronic communications services. An NFP licence was designed for communications systems. A facility that principally provides secure space, electricity, cooling and physical access could sit between them.
The Authority did not preserve that split. Its published response to the consultation moved commercial data centres into NFP-T2, while allowing existing NFP-T1 and NFP-T2 licensees to add them without another licence.
CA’s reasoning deserves to be stated in full. It said data centres support critical information infrastructure; exercise significant control over customers’ access to physical infrastructure, network resources, and data; and should be overseen in a manner comparable to tower companies. Its consultation responses also referred to investor protection, continuity for customers, protection of end users, unlawful services, uptime, redundancy, and failover.
Those are legitimate public-interest concerns. They also establish why the question is not “regulation or no regulation”. A facility can be systemically important without deciding where a packet travels. A power failure, cooling fault, physical-security breach or cross-connect error can disable many customers at once.
The harder question is whether every risk created inside a data centre is a network-provider risk.
Part II · One Label, Several Businesses
“Data centre” describes a facility, not a single business model.
A pure colocation operator may sell secure floor space or racks, electricity, cooling, fire suppression, physical access and cross-connects. A connectivity-rich facility may also operate meet-me rooms, switching infrastructure, internet exchanges or links between carriers. A managed-hosting provider may administer customers’ servers and software. A cloud provider may supply computing, storage and application services. An integrated telecommunications company may own the facility and the fibre that reaches it.
These activities overlap, but they are not identical. The simplest argument flattens that complexity by describing the data centre as a passive warehouse. The final framework risks flattening it in the opposite direction by placing every commercial data-centre operator inside a licence whose principal scope is countrywide communications infrastructure.
The July 2026 NFP-T2 licence terms illustrate the tension. They define licensed systems as transmission, switching or routing systems and other resources that permit the conveyance of signals, then expressly include commercial data centres.
The conditions require, among other things, network schematics; reasonable and non-discriminatory colocation; interconnection; quality-of-service arrangements; numbering and number portability where relevant; delivery of emergency traffic; emergency connectivity; access to sites and records; approval and testing of billing procedures; and a plan to transfer customers if a service is discontinued. One provision permits inspectors to request subscriber billing information and call-data records. Another requires a licensee to make its systems available for emergency services.
Some of those duties fit an operator that runs connectivity. Some fit any critical facility. Others appear designed for a carrier with subscribers, numbers and traffic records. Several conditions are conditional or allow the Authority to excuse performance where it would be unreasonable. The public licence, however, does not contain a data-centre annex explaining which duties apply to a colocation-only operator and which do not.
That is the classification problem in practical form. The issue is not the word telecommunications. It is whether obligations written for one function follow a business that performs another merely because both occupy the same physical stack.
A better boundary would regulate the function actually supplied. Baseline duties for physical security, resilience, incident reporting and service continuity can attach to commercial data centres. Interconnection, numbering, emergency traffic and network obligations can attach where an operator supplies the relevant communications function.
Kenya’s current public documents do not yet show that separation.
Part III · The Base Matters More Than the Rate
The annual percentage looks small. Its economic effect depends on the base beneath it.
Condition 28 of the NFP-T2 licence requires 0.4% of “audited annual gross revenues accruing from the Licensed Systems” or KSh800,000, whichever is higher. The minimum and percentage meet at KSh200 million of annual licensed-system revenue.
Below that point, the effective rate is higher than 0.4%:
That makes the annual minimum most significant for smaller operators. The KSh15 million initial fee may be more consequential still. NFP-T3 carries a KSh200,000 initial fee; a new pure-play commercial data centre enters through NFP-T2 at 75 times that amount, even if it operates one local facility and no public network.
For a hyperscale project costing tens or hundreds of millions of dollars, KSh15 million may be marginal. For a smaller edge facility, local colocation entrant or specialised operator, it may not be. The Authority has not published, in the materials reviewed for this article, a regulatory-impact assessment showing the expected distribution of facilities by size, the cost of supervising each type or the likely effect of the fees on entry.
Then comes electricity.
In its consultation submission, IX Africa Data Centre told CA that electricity represents at least half of a data centre’s turnover and is commonly re-billed to customers. That is the operator’s evidence, not an independently established Kenyan industry average. It nevertheless identifies an accounting question with direct policy consequences.
If a facility already above the KSh200 million threshold buys KSh10 million of power, records the customer reimbursement as licensed-system revenue and CA includes that reimbursement in the base, the marginal 0.4% charge on that amount is KSh40,000. Below the threshold, the KSh800,000 minimum—not that marginal calculation—controls. Whether the reimbursement belongs in the regulatory base at all is not settled publicly.
CA’s response in the consultation matrix was that billing would apply to “the licensed services”. The final licence uses the related but not identical expression “gross revenues accruing from the Licensed Systems” and requires the licensee to show accounts related to the licence separately. Neither the published schedule nor the licence terms expressly say whether verifiable, separately metered electricity reimbursements may be excluded.
That distinction matters. If the reimbursement is included, the charge rises when power consumption or electricity prices rise—even if the operator’s value added and margin do not. At a hypothetical 5% net margin, a fee equal to 0.4% of revenue would represent 8% of profit before any accounting or behavioural effects. That is an illustration, not a claim about the margin of any named Kenyan operator.
If CA excludes separately identified power reimbursements, the central economic objection weakens sharply.
The charge should also be named accurately. It is an annual operating licence fee, not a tax in law. Economically, it behaves like a gross-revenue levy. Unlike a profit charge, it remains due when margins contract. Unlike a risk-based charge, it does not automatically change with outage history, customer concentration, rated IT load or the network functions an operator actually performs.
There may be a second revenue-linked charge. Condition 2.3 of NFP-T2 requires the licensee to contribute to the Universal Service Fund as prescribed. The Universal Access and Service Regulations apply the levy to licensees offering communications systems and services commercially, at no more than 1% of gross revenue; CA has publicly described the contribution by communications providers as 0.5%. The 2026 data-centre documents reviewed for this article do not state expressly whether that rate remains the applicable one for a colocation-only NFP-T2 operator or what revenue base would be used. If 0.5% applies to the same data-centre revenue, the combined variable charge could be 0.9%. That remains a question for written clarification, not a settled invoice.
That does not prove it will be passed to customers. An operator may absorb the fee, renegotiate its power treatment, reduce another cost or spread it across services. Competitive pressure and contract structure will determine the result. Claims that it will automatically raise Kenyan cloud prices, fintech charges or the cost of a mobile-money transaction go beyond the available evidence.
The prices to monitor are nearer the mechanism: power pass-throughs, rack rates, cross-connect charges, interconnection fees and the regulatory surcharges disclosed in new contracts.
Current capacity also cautions against assuming an immediate consumer-price effect. A State Department for ICT and the Digital Economy survey presented in 2026 covered seven facilities between December 2025 and February 2026. It reported 12.6 MW of installed IT load and 2.74 MW in use—about 78% headroom—alongside 162.5 MW of planned future capacity. The sample is not a census; planned capacity is not financed or commissioned capacity; and the survey does not establish that the unused load is commercially available or substitutable between customers. If it is, competition for demand could constrain immediate pass-through. The first effects could instead appear in returns, project phasing, financing or consolidation. That is a hypothesis for operator accounts and prices to test.
Part IV · The Authority’s Strongest Case
The strongest defence of the framework is operational, not semantic.
Data centres are points of concentration. A single facility may host banks, payment processors, cloud regions, government systems and communications providers. The operator controls physical access, power continuity, cooling and the interconnection environment. A failure can propagate well beyond its walls. A simple licence gives the regulator one accountable entity, common reporting duties, inspection powers and a route to intervene before customers are stranded.
A gross-revenue base also has administrative advantages. Revenue is usually easier to audit than profit. A capacity charge can overstate the burden of an under-used facility and invite disputes about commissioned, available and contracted megawatts. A profit-linked fee can be moved by financing structure, depreciation and related-party costs. A uniform category may be easier for a capacity-constrained regulator to supervise than a bespoke licence for every business model.
The United Kingdom provides useful opposing evidence to the claim that a communications regulator has no place here. The UK designated data infrastructure as critical national infrastructure in 2024. Its 2026 Cyber Security and Resilience proposal would put qualifying data centres under Ofcom, with thresholds based on rated IT load and duties focused on proportionate security, resilience, information and incident reporting.
The comparison does not settle Kenya’s choice. The UK proposal is not yet a complete operating regime, its grid and market are different, and critical-infrastructure designation is not a subsidy. It does demonstrate a narrower principle: a facility need not inspect packets to create communications-system risk.
The answer to CA’s case is therefore not that data centres are merely real estate. It is that a legitimate resilience objective does not by itself explain why every commercial facility needs the full NFP-T2 rulebook, why a local pure-play entrant owes the same KSh15 million initial fee as a countrywide network operator, or why reimbursed power should be included in licensed revenue if that is how the Authority interprets the rule.
Regulatory authority and regulatory calibration are separate questions.
Part V · The Incumbent Edge
The framework creates an asymmetry that deserves measurement.
An existing NFP-T1 or NFP-T2 licensee may establish commercial data centres without an additional licence. A new standalone data-centre operator must enter through NFP-T2 and pay the initial fee.
That is not a free pass for incumbents. Existing licensees have already paid for their licences, carry the wider obligations and will ordinarily add data-centre revenue to the accounts associated with their licensed systems. Avoiding a second licence also prevents duplicate regulation of one legal entity.
But the rule may still favour firms already inside the telecommunications perimeter. They begin with the credential, regulatory relationship, network assets and customer distribution that a pure-play entrant must assemble. A KSh15 million fee that is immaterial to a national carrier can be material to a smaller specialised facility. If the operator-level licence covers additional sites, scale can spread the fixed entry cost further.
That does not establish that projects will be cancelled or that the market will consolidate. Those are hypotheses. The relevant baseline is currently missing from CA’s public materials: how many commercial data-centre operators and facilities existed at commencement, which already held NFP-T1 or NFP-T2, how much rated IT capacity each controlled, and how many new pure-play applications have since been filed, approved, withdrawn or refused.
The competitive effect will be visible in that distribution. If pure-play entry continues, new capacity grows and smaller facilities remain viable, the barrier argument will weaken. If most new capacity is built by existing network licensees while standalone applications stall, the asymmetry will deserve closer scrutiny.
The data-centre revenue base now needs precision before accounting practice hardens into policy.
Part VI · Three Other Ways to Match Rules to Risk
Kenya is not an outlier merely because it regulates data centres. Governments are bringing these facilities into security, telecommunications, energy and planning regimes as computing becomes more concentrated and power-intensive. The useful comparison is not who regulates. It is what the instrument follows.
Vietnam places data centres and cloud services inside its 2023 Telecommunications Law, whose relevant provisions took effect in January 2025. But it uses registration or notification, technical conformity and cyber, data and service-quality duties rather than treating every facility as a national network provider. The model is lighter at entry, although Vietnam’s administrative system and investment policy differ substantially from Kenya’s.
Singapore follows scarce resources and verified performance. Its Green Data Centre Roadmap and second capacity-allocation round require successful new projects to meet stringent efficiency, certification and green-energy conditions. The December 2025 call made at least 200 MW available, with Green Mark Platinum, PUE of 1.25 or better at full IT load and eligible green-energy pathways for at least half the new capacity. Singapore also supports efficiency investment. That model reflects an island with acute land and power constraints and cannot be copied wholesale.
The European Union offers a narrower lesson. Its current framework requires qualifying facilities to report standardised energy and water indicators, including PUE and WUE. It does not yet impose one EU-wide maximum for both measures. Measurement comes before a universal performance claim.
Together, the comparisons suggest a design rule: security obligations can follow criticality; environmental obligations can follow energy and water use; network duties can follow network operation; and fees can follow the cost of supervising those functions. Putting every objective inside one legacy licence is administratively simple. It is not necessarily proportionate.
Part VII · What Proportionate Implementation Would Look Like
Kenya does not need to reopen the question of whether commercial data centres matter. It needs to make the current regime legible and matched to the risks it intends to control.
First, CA should publish binding guidance on the fee base. The guidance should define “gross revenues accruing from the Licensed Systems”, state the treatment of separately metered and invoiced electricity, explain inter-company and pass-through items, and provide worked examples. If power reimbursements are excluded, the rule should say so. If they are included, the Authority should explain why utility consumption is an appropriate proxy for the regulatory burden.
Second, the Authority should publish a data-centre annex to NFP-T2. It should identify which conditions apply to pure colocation, which arise only when the operator supplies connectivity or network services, and how mixed businesses should separate accounts and obligations. A rule can remain technology-neutral without being function-blind.
Third, the initial and minimum annual fees should be supported by a regulatory-impact assessment. Options include tiers based on rated IT load, facility criticality, regulated functions or a combination of these. Each has weaknesses: capacity can be under-used, complexity can be gamed, and a low flat fee may underfund supervision. Publishing the cost model would allow the trade-off to be tested rather than assumed.
Fourth, measure before prescribing performance. A common baseline should include operational and contracted IT load, PUE, WUE, renewable-energy share, outage frequency and duration, significant incidents, customer concentration and recovery performance. Aggregate publication can protect security-sensitive information while showing whether the regime improves resilience.
Fifth, publish the market outcome. CA should identify licensed commercial data-centre operators separately from the wider NFP register and report applications, approvals, withdrawals, facilities and capacity by operator type. That would show whether the framework is attracting investment, favouring incumbents or doing neither.
Finally, review the regime after a defined implementation period. The review should test fees, compliance cost, entry, concentration, incidents and customer prices against an April 2026 baseline. A regulation intended to protect critical infrastructure should be judged by the resilience it produces, not by the revenue it collects or the number of forms it generates.
Part VIII · The Precursor
The simplest argument is that data centres are passive buildings, the regulator has mistaken them for telecom operators, and the 0.4% charge will flow through the digital economy.
The evidence supports a more exact warning.
Data centres are not merely buildings. They are concentrated operational systems whose failure can affect many institutions at once. CA has a credible case for oversight. But commercial facilities perform different functions, and Kenya’s chosen licence carries obligations and fees designed for national communications networks.
The policy will become a barrier to competition under specific, observable conditions: if pass-through power is included in the revenue base; if irrelevant carrier duties are applied to colocation-only facilities; if the KSh15 million entry fee deters smaller pure-play operators; and if existing NFP licensees capture most new capacity because they enter with the licence already in hand.
It will look better calibrated if CA excludes verifiable power reimbursements, distinguishes functions inside the licence, new standalone operators continue to enter and measurable resilience improves without material price increases.
Those outcomes can be observed. That is what makes this a precursor rather than a prediction.
The number to watch is not 0.4% in isolation. It is a pattern: standalone applications and withdrawals, the operator behind each commissioned megawatt, changes in rack and power prices, and whether resilience improves. Grid access, land, financing and customer demand will move those measures too. Licensing should be credited—or blamed—only where the evidence.
COVER PHOTO: 2024 signing of MOU between Kenya and the United Arab Emirates that will see the developmentof the first-ever data centre powered by geothermal energy
