Kenya and Nigeria are two of the largest digital-lending markets in Africa. In Kenya alone, licensed digital lenders had disbursed KSh 150.56 billion across more than 8.37 million loans by May 2026, according to the Central Bank of Kenya. Both countries have spent the past few years doing the same two things: bringing digital lending under a formal licence, and passing data-protection law that limits how far a machine can decide a loan on its own.
For a lender running AI in credit decisions in either market, that produces a concrete bar. A person has to stay on the material decision. The lender has to be able to explain how a decision was reached. And there has to be a record a regulator or a borrower can ask to see. Here is what each market requires, and how a credit decisioning platform can be built to meet it.
Kenya: licensed lending, restricted automation
Kenya regulates digital lending through the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022. The CBK licenses digital credit providers and vets them on business model, consumer protection, and the fitness of their owners and managers. By mid-2026 it had licensed more than 250 providers out of over 800 applications received since 2022. In the CBK's account, the regime exists to address high borrowing costs, unethical debt-collection methods, and the misuse of customers' personal information.
Data protection law sits on top of that licence. Kenya's Data Protection Act 2019, enforced by the Office of the Data Protection Commissioner, follows the GDPR model, and two of its provisions bear directly on AI in credit.
First, Section 35 gives a person the right not to be subject to a decision based solely on automated processing, including profiling, where that decision significantly affects them. A loan approved or declined with no human involvement sits inside that right. Second, Section 31 requires a data protection impact assessment before any processing likely to be high-risk, which the ODPC's regulations spell out as covering automated decision-making that determines access to services.
The ODPC has moved past guidance into enforcement, having issued 184 compensation orders, 134 enforcement notices, and 20 penalty notices since the Act took effect, with digital lenders among the businesses penalised for how they handle consent and personal data.
Nigeria: a lending crackdown and a data law with teeth
Nigeria splits the same two layers across two regulators.
On lending conduct, the Federal Competition and Consumer Protection Commission issued its Digital, Electronic, Online, or Non-Traditional Consumer Lending Regulations in 2025, effective from 21 July 2025, with a compliance deadline of 5 January 2026.
Any lender operating through an app, a website, or another non-traditional channel now has to register with the FCCPC, and the rules were written to stop unethical debt recovery, unauthorised access to borrowers' data, and predatory pricing. When a trade body challenged the FCCPC's authority, the Federal High Court in Lagos upheld the regulations in July 2026, clearing the way for full enforcement.
On data protection, the Nigeria Data Protection Act 2023 created the Nigeria Data Protection Commission and set out GDPR-style rights. Section 37 gives a person the right not to be subject to a decision based solely on automated processing that carries legal or similarly significant effects, along with a right to human intervention and to contest the outcome. Section 27 separately requires a lender to inform a borrower, before it collects their data, that automated decision-making or profiling is in play and what it means for them. A DPIA is mandatory before high-risk processing, automated decision-making included.
The NDPC enforces this actively, having fined Fidelity Bank ₦555.8 million in August 2024 for processing customer data without proper consent. It is also turning toward AI head-on: in June 2026 it announced a review of the NDPA aimed specifically at artificial intelligence, robotics, and big data, arguing that a law which once referred to emerging technology in general terms now has to address it directly.
The common bar both markets set
Different regulators, different statutes, but the demands on AI in credit line up. For example, a person has to hold the material decision. Both data laws restrict decisions taken solely by machine where they significantly affect someone, and a credit approval or rejection is the plainest case of that. Keeping a human on the decision is the way through.
The lender has to be able to explain a decision and stand behind it. A borrower who can object to and challenge an automated outcome forces the lender to show what actually drove it.
High-risk processing has to be assessed and written down. A DPIA ahead of automated credit decisioning is required in both markets, and it assumes the lender can describe how its system handles data and reaches a result.
And there has to be a record. Enforcement in both countries runs on evidence — traceable consent, records of processing, an audit trail that holds up when a regulator asks. A lender that cannot produce that record cannot show it complied, however capable its model.
Where Sentinel AI fits
Sentinel AI is FinBox's credit decisioning platform. It runs a low-code business rule engine that lenders use to design, test, and deploy credit policy live, with a library of configurable AI agents and an orchestration layer that chains them into end-to-end lending workflows. The agents sit on top of the rule engine, so the policies, the audit trail, and rollback all stay where they were. That design happens to answer each of the four demands above.
What the rules require
| How Sentinel is built for it
|
No decision made solely by machine
| The rule engine holds the decision while agents assemble context and recommend. The orchestration layer folds each agent's output into a single result that can be sent for human review, and agent guardrails flag uncertainty as "Needs review" rather than letting it pass.
|
A borrower's right to an explanation and a challenge
| Every agent run is stored as a governed case showing which agent and which rule produced each approval or rejection. Agents return structured output that can be read back, not free-form prose.
|
A DPIA and records of processing for high-risk AI
| Each case keeps a full trace of its inputs, tool calls, and output — the documented account of how a decision was reached that both a DPIA and an audit depend on.
|
An audit trail that survives enforcement
| Policy logic is versioned like production software, from Draft to In Review to Ready to Deploy, with maker-checker on every change, role-based access, and one-click rollback.
|
Data handled with clear provenance | Structured inputs and per-case traces give every decision a clear lineage, and decision data stays inside the lender's own environment. |
The human-oversight guarantee is what answers the automated decision restriction most directly. Sentinel AI’s engine keeps the decision while its agents do the assembly work that would otherwise fill an analyst's day, so the AI recommends and a person decides. That is the split both Kenya and Nigeria are pushing lenders toward.
The audit trail is what matters where enforcement actually bites. Regulators in both countries penalise on evidence rather than intent, and a lender's exposure usually comes down to whether it can produce a record on demand. Because Sentinel stores every decision as a case tied to the agent and rule behind it, that record is already there when the regulator asks, instead of being pieced together afterward.
Sentinel AI for Kenya and Nigeria
Sentinel AI’s agent library is getting new document agents: ones that read the national ID, KRA PIN, and M-Pesa and local bank statements in Kenya, and the BVN, NIN, and local bank statements in Nigeria. Building those agents is the platform's core motion, not a special project. The document agents are market-specific; the engine, orchestration, versioning, and case-level audit trail under them are already running in production.
The governance both markets ask for belongs to that platform rather than to any single agent, so it comes along for free. A team writes a new agent's job, rules, and output in plain language, and the agent inherits the same governed engine, the same version control, and the same audit trail as everything already live.
When it comes to cross-border data, both countries restrict moving personal data outside their borders, which is a real question for any credit AI that sends borrower data to a model hosted elsewhere. Sentinel AI is designed to keep decision data inside the lender'senvironment, and its AI engine is selectable per agent — the two levers that matter for keeping personal data in-country. Aligning a specific deployment with each market's transfer rules is part of the localisation work, not something carried over from India.
Where this is heading
Neither regulator is finished. Nigeria has already said it will rewrite its data law to speak to AI directly, and Kenya's ODPC has indicated closer attention to automated decision-making. The rules on how a machine may decide a loan are getting more explicit, and the enforcement behind them is already live.
For a lender weighing how to bring AI into credit in Kenya or Nigeria, that trajectory is the point. Decisioning that is governed, explainable, and kept under human control meets the rules on the books now and leaves room for the ones both regulators are drafting next.
