Kenya’s lenders must name who can overrule the machine.

The regulator ended the blacklist.

In April 2020 the Governor of the Central Bank of Kenya set out what the country’s credit reference bureaus held. There were 378 million records, 42 million of them negative, and 13 million of those negative listings were for debts below KSh 1,000. Borrowers had complained that records stayed negative long after they paid, that lenders were slow to correct listings made in error and that unregulated mobile lenders used the bureaus to harass people who fell behind.

No complaints desk could have unwound 13 million listings, so the central bank changed the rules. Regulations in force from 8 April 2020 banned negative listings for debts of KSh 1,000 or less, which the Governor said would clear more than five million borrowers. The bank also withdrew unregulated digital lenders’ approval to report defaulters to the bureaus. “A customer’s credit score shall not be used solely to deny the customer a loan,” says regulation 40 of the same rules, and a lender that breaches it is liable to a penalty of KSh 2m.

In a survey published in July 2025, the central bank found that half of 125 lenders and credit bureaus had adopted AI by the end of 2024. Credit risk assessment was the most common use, cited by 65% of adopters, and only 56% of adopters had measures to make their models explainable. In September, The Standard reported that one tier-one lender’s machine-learning models score borrowers and approve mobile loans worth KSh 1.5bn a day.

In July the Office of the Data Protection Commissioner issued a draft guidance note on AI, which went out for consultation in August. It says a customer who contests an automated decision must reach “a human with authority to reverse or modify the decision”. It adds that standards for human oversight should cover what reviewers are authorized to do, how competent they are, and what information they see. On 10 September the central bank opened consultation on its own draft guidance on AI in banking, published alongside draft risk management guidelines. Comments are due on 7 November.

One stale record cuts a trader’s limit.

A hardware trader in Nakuru has borrowed through her phone for three years and repaid every loan. She is a composite, built from the published rules and the complaints the central bank recorded in 2020, and represents no single lender’s customer. On a Monday morning her limit falls from KSh 30,000 to zero. The text message says her limit has been reviewed.

Overnight, the lender’s system pulled her mobile money flows, her repayment record, and a fresh bureau report. The bureau report still showed a loan from another lender as overdue, though she cleared it in August, because that lender had not sent the update. The regulations require a lender to update the bureaus immediately when an account changes and a bureau to post the update within two days of receiving it. A missed update breaks the chain at its first link, and the model downstream cannot tell.

The model read the arrears as fresh risk, and her score fell below the cut-off. The lender’s credit committee had set that cut-off months earlier. The system applied the policy attached to it, which was to withdraw the limit and review the account in 90 days. Nobody looked at the file, because the policy did not ask anyone to.

She phones the contact centre. The agent sees a zero limit and a reason code that says “score”. He cannot see which record moved it, and he has no authority to restore a limit or pause the withdrawal. He logs a complaint. At a contact centre that measures agents on call-handling time, nothing rewards him for escalating it.

The complaint reaches a credit analyst on the digital lending team. She can open the bureau report, spot the stale entry and ask the trader for proof of payment. Whether she can then restore the limit depends on the lender’s override policy. If it allows her to, the trader borrows again that afternoon. If it does not, the trader waits for the other lender to correct its record, which it has 21 days to investigate once a dispute is lodged, and then for the next overnight run. A trader who restocks weekly can lose most of a month’s trade to one missing update.

Three powers can stop a decision.

The first power changes one decision for one customer. Section 35 of the Data Protection Act gives a person the right not to be subject to a decision based solely on automated processing that significantly affects her. The Act allows such decisions where they are needed to perform a contract, which covers most lending. It also requires the lender to tell the customer in writing that a machine decided. She can then ask for the decision to be reconsidered or for a new decision that is not solely automated. On Precursor’s review, those safeguards apply even where the automation itself is permitted. The 2021 general regulations add a duty to explain the logic involved and to let the person obtain human intervention.

The second power changes a rule for a group of customers, such as the cut-off, the treatment of a bureau record that may be stale or the length of a review period. It belongs to the credit committee, and it works only if complaints reach the committee as evidence. Every customer whose limit fell on a stale record needs the same correction, and an analyst who fixes one file at a time will never see the pattern.

The third power stops the system. Someone must be able to switch a model off, roll it back to an earlier version or send decisions to a simpler rule while a fault is fixed. According to a published legal summary, the central bank’s draft risk management guidelines place ultimate responsibility for risk oversight with the board. They expect directors to understand where AI is used and how failures are escalated, and they make business units own the risks of the AI they use.

A lender that has written down only the first power can correct its errors one customer at a time and has no route for stopping them.

Appeals succeeded while the machine ran on.

Between 2016 and 2022, Australia’s Administrative Appeals Tribunal issued 431 first-tier decisions questioning income averaging, the calculation behind the automated welfare debts known as Robodebt. The decisions went unpublished. The department rejected their reasoning and kept averaging, and the most senior official responsible was not told of them. Individual appeals succeeded while the scheme kept issuing debts. The Royal Commission that reported in 2023 condemned the scheme as cruel, unfair, and unlawful.

In October 2024 the US Consumer Financial Protection Bureau ordered Apple and Goldman Sachs to pay US$89m over the Apple Card. Apple had failed to pass tens of thousands of customer disputes to Goldman, and Goldman had not investigated the disputes it did receive as federal rules required. Customers were left waiting for refunds, and some found wrong negative entries on their credit reports. The appeal route broke at the hand-off between two partners. Many Kenyan mobile loan products are run by a bank together with a mobile-money operator or a technology partner, and each has a hand-off in its complaints route.

In December 2023 the EU Court of Justice held that a credit bureau’s score can itself count as an automated decision when lenders draw strongly on it, partly because the borrower otherwise could not get an explanation of the logic from anyone. Kenya’s regulation 40 reached a similar place by a different road, by forbidding a lender to rest a refusal on the score alone.

Human overrides cut both ways.

In 2013 the US National Bureau of Economic Research published a study of 242,011 consumer loan applications at a European bank. It concluded that loan officers paid on volume re-scored applications with altered inputs to push them over the cut-off. After the bank tightened its cut-off, loans that went through more than two scoring attempts defaulted at 3.67%, against 2.28% for the rest.

A randomized trial among US trade creditors, published in the Journal of Accounting and Economics in 2020, found the reverse. Lenders given a slider to adjust a third-party model’s recommended credit lines saw defaults fall 13% more than the control group’s over a short follow-up period. The gains came from the most opaque borrowers, private firms with no social media presence, where the lender knew something the model did not.

An override helps when the reviewer brings information the model lacks and has no stake in volume, and it hurts when the reviewer is paid on approvals. Every override should therefore carry a written reason, and someone outside the sales line should audit a sample.

A scorecard trades accuracy for recourse.

A Kenyan lender can score borrowers with a machine-learning model that draws on hundreds of signals or with a scorecard of a dozen factors, each with a fixed weight. A study of US mortgage data, published in the Journal of Finance in 2022, found machine-learning models predicted default significantly better than a standard statistical model. It also found they widened differences in pricing across and within groups of borrowers, producing clear winners and losers.

Each factor in a scorecard produces a reason an agent can read aloud and an analyst can check, so the trader’s case would have reached “bureau arrears” in the first minute of the call. A scorecard uses less personal data, which narrows the data protection impact assessment the regulator’s draft expects for AI credit scoring. It drifts more slowly and is easier to recalibrate.

The central bank’s survey found 35% of AI adopters using third-party providers for AI services, and 52% citing dependence on third parties as a risk. The data regulator’s draft leaves accountability with the institution that deploys the system, wherever the model was built. A lender that cannot change its own cut-off or roll back a model without its supplier has handed the third power to someone the customer never meets.

A lender can also keep the machine-learning model for ranking and require every adverse decision to carry its main reasons in plain language, which the regulator’s draft already expects to be available on request for credit scoring. Scores close to the cut-off, and every contested decision, can then go to a person.

A month of review costs less than one penalty.

In an illustrative case, a lender makes 200,000 adverse decisions a month, meaning declines and limit cuts, and 2% of them are contested. Reviewing 4,000 cases at 20 minutes each, with an analyst’s time costed at KSh 1,000 an hour, comes to about KSh 1.3m a month, the work of roughly eight analysts. Reviewing every adverse decision would cost about KSh 67m a month and need some 400 analysts, which is why the person belongs on contested and borderline cases.

Regulation 40 sets a KSh 2m penalty for refusing a loan on the score alone. The Data Commissioner can fine up to KSh 5m or 1% of turnover, whichever is lower. In 2020 a High Court judge ordered the Higher Education Loans Board to pay KSh 10m to a lawyer whose name stayed on a bureau’s list for about three years after the board had reversed the disputed money. The board had blamed the listing on a technical malfunction. She had raised it with the board several times and been told to put it in writing.

Every link in the chain needs an owner.

Precursor’s map, built from the Data Protection Act, the 2021 general regulations, the 2020 credit reference bureau regulations and the regulators’ draft guidance. No Kenyan rule yet requires the first-contact freeze.

A board can test the override with 10 cases.

In 2020 the stop came from outside the lenders as a regulation and a mass delisting. The consultation that closes on 7 November gives boards a chance to show that the next stop can come from inside. If the central bank’s final guidance follows the data regulator’s draft, lenders will need evidence that their reviewers change outcomes.

A board can ask management to run 10 contested decisions from this month through its own system, from the customer’s first call to a written answer. Management should then report who answered, what that person could see, whether they had authority to change the outcome, how many days it took and whether any reversal changed a rule. If no reversal changed a rule, the lender will keep correcting its errors one customer at a time while the cause stays in place, and the next trader in Nakuru will lose her limit at the next overnight run.