Incubation hubs and AI guidelines now a must for digital lenders

The Office of the Data Protection Commissioner is mulling a sandbox where digital credit providers (DCPs) can host new technologies. This comes amid the rollout of new guidelines on how artificial intelligence (AI) can be applied for lenders.

Data Commissioner Immaculate Kassait said her office has already benchmarked with the Capital Markets Authority (CMA) on how the sandbox will operate.

These innovations in the sector are expected to further strengthen data protection even as Kassait insisted that DCPs should revise their policies to include alternative dispute resolution (ADR) mechanisms when dealing with disgruntled customers.

However, Kassait, while speaking during a recent workshop by the Digital Financial Services Association of Kenya (DFSAK), pointed out an emerging trend where customers fake harassment to avoid paying loans.

She noted that in other markets, data protection laws are being amended to include technologies that are gaining traction in the market.

This then informs the expected guidelines on AI and the push for DCPs to review their policies. “I have seen countries like Singapore have reviewed their data protection guidance to accommodate these trends,” she said.

She noted that even as new guidelines are in the offing, there is a need to be careful so that it is not seen as if the regulator is stifling innovation in the sector. “One of the things we said we will do this financial year is to come up with guidance on AI,” she said. “We also want to have a sandbox. It is part of our strategic plan.”

Kassait said a team has already benchmarked with the CMA on the introduction of the sandbox, whose exact timelines are yet to be made public.

“A sandbox is a safe environment. Some of these technologies, like AI, when you have a sandbox and it is a policy, you can look at how best to inform the industry,” she said.

A sandbox is an experimental or incubation area where products are tested and perfected before they are released into the market. CMA has such as one of the ways of deepening the capital markets.

The Data Commissioner said the country's strategy on AI, as unveiled by the ICT and Digital Economy Cabinet Secretary William Kabogo, will offer direction on how the guidance will be drafted. “We should not use AI as a black box, which we then become more discriminatory,” she said.

She noted that since some of the challenges with AI are already known, there is a need to strike a balance between its application and overreach. “We have to think of a way to balance challenges or purpose limitation in terms of the collection of data,” she said.

Senior Director, Legal for Tala Nicola Muriuki, a digital lender, pointed out the need for regulations on the emerging issues facing the sector, among them AI. “I hope we can explore joint strategies for future-proofing data protection, particularly AI as the main field,” she said.

Innovations such as AI in the sector may become helpful when it comes to sieving genuine from fraudulent complaints, an issue that Kassait has noted is getting traction in the sector.

She pointed out that some customers are devising ways not to pay up loans by faking messages from lenders claiming harassment, and would push the Data Commissioner to reprimand the provider. “We dismiss such cases. You cannot use the law to try and beat the purpose of contracts,” she said.

DFSAK Chairperson Kevin Mutiso said the association is pushing for a comprehensive framework that will have both sides listened to whenever a customer says they have been aggrieved.

“The way you do that is by making sure you have a comprehensive framework to have all sides listened to. The customer has a right to complain if they feel they have been aggrieved by the product, but the business should also have a chance to give their side of the equation,” he said.

He pointed out that the sector, which boasts of eight to 12 million customers, finances 300,000 smartphones every month, 70 per cent of all new bodabodas, has its hand in e-bike adoption and disburses almost Sh500 million a day to the informal economy.

Mutiso noted that even as the regulators are coming up with guidance to steer the sector forward and rid it of the chaff, there is a risk of overregulation.

He pointed out that the Central Bank of Kenya (CBK), which has published The Central Bank of Kenya (Non-deposit taking credit providers) Regulations, 2025, is encroaching on its mandate in the data area.

“Overregulation does not hurt the business; it hurts the customer more,” he said, explaining that this causes additional regulatory costs that come with overcompliance, curbing of innovative ideas and a lack of a consumer redress mechanism.