SME Compliance Checklist

Register your business name or company via eCitizen BRS.

Get a KRA PIN for your business. KRA PIN is required for all tax transactions.

Apply for a Single Business Permit from your county government.

Check and obtain any industry-specific licences (health, food, liquor, etc.).

Create an iTax account on the KRA portal for filing tax returns.

Register for KRA eTIMS to issue electronic tax invoices.

File VAT, PAYE, or income tax returns on time. Late filing attracts penalties.

If you supply goods/services to government entities, understand withholding VAT rules.

File your annual income tax return by June 30th each year.

Open a dedicated business bank account separate from personal accounts.

Get a Till Number or PayBill for business payments via M-Pesa.

Set aside 3–6 months of operating expenses as a business emergency fund.

Consider business insurance (fire, theft, public liability, professional indemnity).

Use accounting software or a simple ledger to track income and expenses.

Register for NSSF if you have employees. Mandatory employer contribution.

Register for the Social Health Insurance Fund for your employees.

Use written contracts for your employees. They are legally required for qualifying longer contracts; continuing casual work can also change the worker's legal position.

If you hire recent graduates, check HELB compliance requirements.

Ensure your business permits and licences are visibly displayed at your premises.

If you handle customer or employee personal information, check whether ODPC registration applies. For profit-making businesses, the general exemption requires both total income in the previous year below KES 5 million and fewer than 10 employees. Some listed activities must register regardless. Privacy duties still apply even if registration is exempt.

Check whether your business qualifies for AGPO, which provides reserved procurement opportunities for eligible businesses owned by youth, women or persons with disabilities.