CBK Governor Puts Banks on Notice: AI Can Score Credit, But Cannot Own the Decision, as East Africa Pushes Lenders Past Collateral

At the 23rd East African Banking School Conference in Diani, Central Bank of Kenya Governor Dr. Kamau Thugge told banks that AI can strengthen lending decisions but cannot absorb the accountability that comes with them. His comment set the tone for a broader push from Kenya Bankers Association Chairman Paul Russo, National Assembly Finance Committee Chairperson Kuria Kimani, and Metropol CRB CEO Gideon Kipyakwai for banks to reduce reliance on collateral and adopt alternative data, including mobile money transaction history and digital payment behaviour, to assess creditworthiness

Kenya's banking sector operates under the Banking Act (Cap 488) and the Central Bank of Kenya Act (Cap 491), both of which give CBK broad prudential supervisory authority over licensed institutions, including risk management practices. CBK has historically exercised this authority through prudential guidelines covering credit risk management, operational risk, and more recently cybersecurity, rather than through a dedicated AI-specific rulebook. There is no standalone Kenyan statute governing AI use in credit decisioning at present.

Digital lending outside traditional banks is governed separately. The Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 brought previously unregulated mobile lending apps under CBK oversight following widespread complaints about predatory lending practices and aggressive data use. Credit reference bureaus, including Metropol, operate under the Credit Reference Bureau Regulations, 2020, which govern how borrower data is collected, shared, and used in credit scoring.

Data use in credit models also sits under the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, enforced by the Office of the Data Protection Commissioner. Any bank building AI credit models on mobile money transactions or behavioural data is processing personal data and is subject to purpose limitation, consent, and fairness obligations under that framework, independent of anything CBK says about credit risk.

Thugge's statement that accountability rests with banks, not algorithms, is not a new legal principle. Under existing Banking Act obligations, a licensed institution cannot delegate its fiduciary and prudential responsibilities to a third-party system or vendor model. What the statement does is put banks on notice that CBK intends to hold that principle firm as AI adoption accelerates, rather than allow "the model decided" to become an acceptable answer during supervisory review or a customer complaint

The practical exposure for banks sits in the gap between adopting AI tools and being able to demonstrate, on demand, how a specific credit decision was reached. Kenyan banks that have deployed AI credit scoring, or plan to, should expect that CBK examiners will eventually ask for documented model validation processes, override logs showing where human underwriters intervened, and evidence that adverse decisions can be explained to the borrower and to the regulator. Banks that cannot produce this today are running ahead of their own governance.

There is also a live question about whether CBK will eventually issue a dedicated prudential guideline on AI in credit decisioning, similar to what it did for digital credit providers in 2022 after harm became visible in the market. Given the pattern of testing positions publicly before regulating, Thugge's remarks in Diani look like exactly that kind of early signal.

Nobody at this conference announced a new rule. What they announced was intent, and in Kenyan banking supervision, intent stated publicly by the CBK Governor tends to become policy within a reasonably short window. Banks that treat this as a talking point rather than an early warning are making a bet that CBK will move slowly. Recent history, particularly the digital credit providers regulation that followed years of unregulated lending app growth, suggests that bet is not a safe one. The institutions that build explainable, well-governed AI credit capability now, rather than after a guideline forces it, will be the ones with genuine competitive advantage when the rules eventually arrive.