KYC/AML Analytics for African Fintech: Learning from the Digital-Lending Data Scandals

Posted Aug 22, 2026

KYC and AML analytics for African fintech

By ML Kenya

5 min read

KYC/AML Analytics for African Fintech: Learning from the Digital-Lending Data Scandals

The scandal that ended “scrape everything” lending

Between 2022 and 2024, Kenya became a case study in what happens when fintech analytics outruns consent. Digital credit apps backed by Silicon Valley and Chinese investors scraped borrowers’ contact lists, photos, location history and mobile-money logs, then used machine learning to score creditworthiness from the hoard (Context, Lookout). Lookout’s Threat Lab found close to 300 predatory loan apps across nine countries — Kenya and Nigeria included — exfiltrating excessive user data and harassing borrowers’ networks (Help Net Security, Ars Technica).

The regulatory response was fast. Google required Kenyan loan apps to prove they held Central Bank of Kenya (CBK) licences and removed hundreds that could not (TechCrunch, Capital Business). The CBK’s Digital Credit Providers Regulations, 2022 brought lenders under formal oversight, with licensing from January 2023 (CBK, Kenya Law). In September 2023 Kenya’s data protection office (ODPC) issued penalty notices totalling KES 9,375,000 across three firms, including KES 2,975,000 against Mulla Pride Ltd (KeCredit, FairCash apps) for using borrowers’ contacts without consent (Kenya News Agency, Clyde & Co).

The lesson for ML teams is subtle: the scandal was not about analytics. It was about hoarding and exfiltration.

What the scandal was really about

The offending apps’ sin was not that they scored borrowers — scoring is legitimate — but that they collected data with no upper bound, no purpose limitation and no deletion policy, then weaponised it. Credit-risk features derived from phone data are a real technique; shipping every contact’s number to a server so defaulters can be pressured through their social network is surveillance. It matters because KYC/AML analytics draws on the same raw material: identity documents, phone metadata, transaction graphs, behavioural signals. The compliance question is never “can we collect this?” but “do we need it, for how long, and who else sees it?”

Identity verification pipelines that respect users

Modern KYC in African fintech should be a purpose-limited verification pipeline, not a data grab. Document verification (national IDs, passports) plus liveness checks confirm a human is present. Phone-data cross-checks — matching SIM-registration name to the ID, or confirming airtime top-up history — add signal without pulling the phonebook. Every feature should carry a documented retention window. If a model needs “customer since” but not “customer’s 4,000 contacts”, only the former should ever reach your data lake.

Transaction monitoring: analytics that would have caught Danske

The global cautionary tale is Danske Bank’s Estonian branch, through which an estimated €200 billion in suspicious, largely non-resident payments flowed between 2007 and 2015 — possibly Europe’s largest money-laundering scandal (Reuters, Wikipedia). In December 2022 Danske pleaded guilty and agreed to pay more than $2 billion to US and Danish authorities (Reuters, SEC). The failure was structural: monitoring treated each transaction in isolation while a small branch processed a disproportionate volume of high-risk non-resident flows.

The fix is analytics that sees structure: risk scoring at onboarding and per transaction, watchlist screening against sanctions and PEP lists, entity resolution linking accounts across wallets and mobile-money rails, and automated SAR/STR drafting that leaves investigators with judgment, not paperwork.

Data minimization as an ML constraint

ODPC enforcement and the CBK regulations have made minimization a legal requirement, not an ethical preference. The ODPC’s guidance note for digital credit providers, aligned with GDPR principles, is explicit: collect the minimum, state the purpose, obtain specific consent, delete on expiry (ODPC). Feature stores should version what was used, not what was collected; pipelines should default to ephemeral processing; datasets that cannot justify retention should be scheduled for destruction.

Analytics is not the problem — retention is Every feature in your KYC model should carry a retention window. If you cannot justify keeping a field, you should not collect it at all.

Fairness: scoring people, not surveilling them

Models built on phone-data proxies can penalise users with small networks, prepaid rather than postpaid lines, or rural mobile-money patterns. Fairness evaluation — measuring score distributions and error rates across demographics, and auditing proxies for protected attributes — should be a standard gate in the deployment pipeline. A model that false-positives low-income users disproportionately is not just unfair; it is a regulatory and reputational liability.

Analytics for trust, not surveillance

The compliance stack that survives regulators is the one that turns data into decisions while protecting users: verification pipelines with retention limits, monitoring that detects structure rather than hoarding behaviour, watchlists applied with entity resolution, machine-readable consent logs, and fairness audits in CI. Done right, KYC/AML analytics becomes the trust layer that lets African fintech onboard faster than incumbents — without becoming the next headline.

Conclusion

Kenya’s digital-lending scandal and Danske’s AML collapse are two sides of the same coin: analytics applied without boundaries — in one case to users’ private lives, in the other to criminal flows. African fintech has the chance to build the compliance stack the industry should always have had: KYC/AML models that are powerful precisely because they are disciplined about the data they touch.

References

Data Science, Fintech

This post is licensed under CC BY 4.0 by the author.