A company that wishes to launch a digital lending platform in several African countries will find that each jurisdiction has its own regulator, its own licensing requirements and its own expectations of how a lender must treat its customers.
Taking South Africa, Kenya and Nigeria as examples, the same product is regulated differently in each country. Four areas in particular warrant early attention: licensing and registration, consumer protection, data protection, and anti-money laundering and corporate structure.
1. Licensing and registration
A digital delivery model does not remove the requirement to be licensed.
Kenya: The Business Laws (Amendment) Act, 2024 brought non-deposit-taking credit providers under the supervision of the Central Bank of Kenya, which licenses or registers them. The Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026 (Legal Notice 191 of 2026), published on 29 September 2026, replace the earlier digital credit provider regime.
Nigeria: Under the Digital, Electronic, Online or Non-Traditional Consumer Lending Regulations, 2025, no digital lending is permitted without approval from the Federal Competition and Consumer Protection Commission (FCCPC). Approval is time-limited and must be renewed periodically (every three years).
South Africa: The National Credit Act 34 of 2005 requires a credit provider to register with the National Credit Regulator (section 40). A credit agreement concluded by an unregistered provider that was required to register is unlawful (section 89(2)(d)).
2. Consumer protection: affordability, pricing and collections
Regulators scrutinise how credit is assessed, priced and recovered. In South Africa, the National Credit Act requires a lender to assess affordability before lending (section 81(2)), limits the charges and interest that may be levied (section 101, read with section 105) and prescribes a notice process before enforcement (sections 129–130). In Sebola v Standard Bank of South Africa Ltd 2012 (5) SA 142 (CC), the Constitutional Court emphasised the importance of proper notice to the borrower before a lender enforces its rights.
3. Data protection
Credit assessment depends on personal information, and each country regulates how it is collected, used and sent abroad:
- South Africa: Protection of Personal Information Act 4 of 2013 (POPIA)
- Kenya: Data Protection Act 24 of 2019
- Nigeria: Nigeria Data Protection Act, 2023
Where data is stored and which service providers are used are therefore legal decisions as well as technical ones.
4. Anti-money laundering and corporate structure
In South Africa, credit providers are accountable institutions under the Financial Intelligence Centre Act 38 of 2001. They must register with the Financial Intelligence Centre, verify customers’ identities and report suspicious transactions. A single group-wide onboarding process will rarely suit every market, and local licensing requirements often make a local operating entity necessary.
Key takeaway: A country-by-country regulatory assessment should precede product development. The regimes in Kenya and Nigeria have both changed materially since mid-2025.
Author: Tshiamo Merciful Mashilo
Legal review: Stella Igidi
Please contact us for more information and/or assistance with all legal matters.
