How borrower verification is changing across Nigeria, Kenya and South Africa

A borrower can have a working phone number, a valid identity document and a real bank account, and still create a problem for a digital lender.

That is because verification is not only about collecting an ID number or checking whether a document exists. A lender also needs to know whether the person applying is really the person behind that identity, whether the information matches reliable records and whether the lender’s understanding of that customer remains accurate over time.

That challenge is becoming more important as digital lending expands across Africa.

Nigeria, Kenya and South Africa are all asking lenders to take customer verification and due diligence seriously. But they are not taking the same route. Nigeria is built around national identity infrastructure such as BVN and NIN. Kenya’s framework focuses on verifying customers through reliable, independent sources and gives lenders practical options that include national-ID checks, biometric authentication and video verification. South Africa’s FICA regime requires a risk-based approach and ongoing due diligence throughout the customer relationship.

The common message is simple: checking a borrower once at onboarding is not enough.

Nigeria: BVN and NIN need to be part of the lending journey

Nigeria has two important identity rails for lenders: the Bank Verification Number, or BVN, and the National Identification Number, or NIN.

For a digital lender, the question is not simply whether the borrower can provide one of these numbers. The question is whether the lender can use available identity infrastructure to corroborate the borrower’s information before relying on it in a credit decision.

Industry guidance published in 2026 describes a stronger move toward real-time BVN and NIN verification instead of delayed or periodic checks. It also describes a tiered identity-assurance approach, where the level of verification rises with the account or customer-risk level.

Lenders should still validate the precise requirements applicable to their institution, product and licence type against the latest notices from the CBN, NIBSS and NIMC. That matters because requirements can differ depending on whether a lender is operating through a bank, microfinance bank, finance company, payment provider or another regulated model.

But the practical direction is clear. Identity checks should happen inside the lending journey, not as a separate exercise after approval.

For a new borrower, this could mean checking their BVN or NIN details against the relevant source, making sure the key information matches, and carrying out extra checks when the lender’s risk policy requires it. Depending on the level of risk, this could include verifying documents, conducting liveness checks, or sending the application for additional review.

The important point is that verification needs to inform the decision. It should not become a delayed back-office task.

Kenya: the focus is proving who is actually applying

Kenya’s verification requirements are often discussed as though they are only about a borrower taking a selfie. That is too narrow.

The bigger point is that lenders need to establish that the person applying for credit is the same person named on the identity record and document they have provided.

The Central Bank of Kenya’s Guidance on Customer Due Diligence applies to non-deposit-taking credit providers, alongside banks, microfinance banks, payment service providers and other CBK-supervised institutions. It requires financial institutions to identify customers and verify their identity using reliable, independent documents, data or information.

The guidance gives practical examples of how this can work. These include cross-checking National ID details against the Integrated Population Registration System, matching account-opening information with the National ID or passport, comparing the applicant’s physical likeness with the photograph on the ID, using facial-recognition selfie verification and using video calls to confirm the applicant’s presence. The guidance describes selfie-based biometric authentication as particularly relevant to Digital Credit Providers and mobile-money providers during account opening.

This gives lenders flexibility, but not a free pass. A lender does not necessarily need to copy the same exact onboarding flow as every other DCP. It does need to be able to show how it established and verified the customer’s identity, why its chosen controls are appropriate for the risk and how it handles cases where the information does not match.

This also goes beyond onboarding. The same CBK guidance requires ongoing due diligence, including reviewing customer activity and keeping customer documents, data and information up to date and relevant, especially for higher-risk customers.

For lenders, that means verification should be part of the credit journey from the start, while customer information should not be treated as permanently valid after the first check.

South Africa: due diligence continues after onboarding

South Africa has a different structure. The central obligation comes from the Financial Intelligence Centre Act, or FICA, which requires accountable institutions to apply a risk-based approach to customer due diligence.

In reality, this means lenders need to understand the money-laundering, terrorist-financing and proliferation-financing risks their business faces, then apply controls that are proportionate to those risks. The current FIC Guidance Note 7B, issued in August 2026, replaced the earlier Guidance Notes 7 and 7A and remains the current formal guidance on how to implement several parts of the FIC Act.

The key point is that the obligation does not end once a customer has been onboarded.

FICA requires ongoing due diligence during a business relationship. That includes monitoring the relationship and taking steps to keep previously collected customer information up to date. Where an institution has doubts about the accuracy or adequacy of information it previously obtained, it needs to address those doubts through its risk-based controls.

FICA does not prescribe one universal digital verification journey. It does not say every lender must use a Smart ID, face matching, liveness detection or a fixed set of automated triggers. Instead, it expects institutions to select and operate controls that match their own risk profile, products, customer base, delivery channels and operating environment.

For a digital lender, that may mean using document verification, reliable independent data sources, screening, fraud checks, monitoring and customer-record refreshes. A lender may decide that signals such as inconsistent customer information, unusual account activity, suspected fraud or a material change in a customer’s profile should trigger a review. Those are operational decisions within the lender’s risk-management programme, not a universal statutory trigger list.

What all three markets have in common

Nigeria, Kenya and South Africa have different identity systems and different regulatory frameworks. But the direction is similar.

First, lenders are being pushed to use more reliable sources of customer information. In Nigeria, that means making proper use of BVN and NIN infrastructure. In Kenya, it means verifying customer identity through independent sources and, where appropriate, connecting the identity document to the person applying. In South Africa, it means applying risk-based CDD using verification methods appropriate to the customer and relationship.

Second, verification is no longer only an onboarding issue.

A borrower can pass KYC when they first apply and still become a different risk later. Customer records can go stale. Fraud patterns can change. A customer’s activity can stop matching what the lender knows about their profile. Regulators in Kenya and South Africa explicitly require ongoing due diligence, while lenders in all three markets need to think about how identity, fraud and customer-risk signals change over the life of a loan.

Third, stronger verification does not have to mean more friction for every borrower.

The better approach is to apply the right controls at the right time. A low-risk returning customer should not necessarily face the same journey as a first-time applicant with inconsistent identity data, a high-risk application or signs of possible fraud. That is what a risk-based approach is meant to enable.

What lenders should get right now

A few principles apply across all three markets:

• Bring verification into the lending flow. Do not treat identity as a check that happens after a borrower has already been approved or funded.
• Use trusted sources where they are available. BVN and NIN checks in Nigeria, government-database and document checks in Kenya, and reliable independent sources in South Africa should be part of the lender’s broader control design.
• Prove the connection between the identity and the applicant. An ID number or document alone may not be enough where the lender needs confidence that the person applying is genuine.
• Design for ongoing review. Keep customer information current, monitor for changes that matter and decide in advance what should prompt a re-verification or escalation.
• Make the controls proportionate. Not every borrower needs the same level of friction. Stronger controls should be used where the lender’s risk assessment shows they are needed.
• Keep a clear audit trail. A lender should be able to show the information it collected, the checks it ran, the decision it made and how it handled exceptions.

Identity verification and credit decisioning have often been treated as separate parts of the lending stack. That is becoming harder to justify.

A lender cannot make a reliable decision if it is unsure who the applicant is, whether the information is current or whether new activity has changed the risk attached to that borrower.

For lenders operating across Nigeria, Kenya and South Africa, there is no single onboarding flow that will work everywhere. The better answer is a configurable verification layer that can connect to local identity infrastructure, apply the right level of checks for the customer and support ongoing review when the risk changes.

The lenders that build that capability now will be better placed to manage fraud, reduce avoidable friction and grow without turning every regulatory development into an emergency project.