Domain Atlas / Lending & credit collections AI
M-Shwari & Kenya's Digital Credit Market
M-Shwari, launched November 2012 by the Commercial Bank of Africa (now NCBA) in partnership with Safaricom over the M-PESA rails, scores customers with fully automated credit approval rules run on six months of the mobile network operator's transaction and airtime record: a score assigned at account opening irrespective of when the customer borrows, never disclosed to the customer, expressed only as a credit limit that is zero below the cutoff and grows on timely repayment. Loans in the evaluated era started at KSh 100 (the minimum has been KSh 2,000 since August 2020, with smaller borrowing redirected to the Fuliza overdraft), run 30 days at a 7.5 percent facilitation fee unchanged from 2012 through 2026, roll over automatically with a further 7.5 percent, and are reported to a credit reference bureau after 120 days of non-payment.[3]
What happened
M-Shwari launched in November 2012 as a partnership between the Commercial Bank of Africa (now NCBA Group) and Safaricom, running over the M-PESA mobile-money service. Its underwriting is fully automated and happens before anyone asks to borrow: a score is assigned when the account is opened, "irrespective of when they choose to borrow," computed from the transaction and airtime record the mobile network operator holds — prepaid airtime top-up value, the number of airtime advances taken, the number of "low days" with the airtime balance below two shillings, mobile-money inflow value, average daily balances, paybill payments, unique counterparties, and bank transfers in. Eligibility requires six months of active M-PESA use plus other Safaricom products, so the excluded population is not a set of rejected applicants but people who never appear in the operator's records at all. Customers are not told their score; they see only a credit limit, zero below the cutoff, growing on timely repayment. Loans in the evaluated era started at KSh 100 (the minimum rose to KSh 500 and then, in August 2020, to KSh 2,000, with smaller borrowing redirected to the Fuliza overdraft), run 30 days at a 7.5% facilitation fee — unchanged from 2012 through 2026 — roll over automatically for another 30 days with a further 7.5% on the balance, and at 120 days of non-payment the borrower is reported to a credit reference bureau. The original scorecard was built on repayment of Safaricom's Okoa Jahazi airtime advances; the Consultative Group to Assist the Poor (CGAP) and Financial Sector Deepening (FSD) Kenya's 2015 product study recorded non-performing loans at 2.2% over 90 days as of December 2014.
The evidence carries both regimes, and neither is asserted away. A peer-reviewed regression-discontinuity evaluation (Suri, Bharadwaj & Jack) found real service-side benefit: 34% of eligible households took a loan, eligible households were 6.3 percentage points less likely to forego expenses in response to a negative shock, and the loans did not substitute for other credit — the authors conclude digital loans improve financial access and resilience while remaining "not a panacea for greater credit market failures." The same evaluation's administrative data show borrowers just above and just below the score cutoff with no significant difference in first-loan default — a coefficient of 0.007 against a control mean of 0.066 — reported by the authors as a check on their study design, local to the cutoff, and nonetheless the only published measurement in this family of what the score separates at the margin where it decides. The market layer is documented at class level. Nationally representative survey evidence (FinAccess 2019, analyzed in the journal PLOS ONE) puts digital-credit default at 13.8% against 6.4% formal, and negative bureau listing at 5.3% of digital borrowers against 1.4% formal — a listing gap wider than the default gap, because lenders write the label at different rates: 38.4% of digital defaults were reported to a bureau against 22.7% of formal ones, and digital credit accounted for roughly 90% of all blacklistings. The Competition Authority of Kenya's market inquiry with Innovations for Poverty Action (a 793-user phone survey plus an audit of provider transaction and account-level data) found a mean effective APR of 280.5% and median of 96.5% across the market, 77% of mobile loan users unable to repay at least once, 40% able to state their last loan's cost within five percent, and 27% aware of other providers' charges. These market figures describe the Kenyan digital-credit market and its app-based lender class — not M-Shwari, which runs on the Subscriber Identity Module (SIM) toolkit and Unstructured Supplementary Service Data (USSD) menus over operator-held records.
The state then intervened three times, in three registers. The Central Bank of Kenya's Credit Reference Bureau Regulations of 8 April 2020 barred negative listings where the amount does not exceed one thousand shillings, forced a one-off mass delisting below that floor, required bureaus to include the customer's credit score in every credit report — and, as the market inquiry records, barred non-bank digital lenders from the credit information system altogether, a bar that stood until licensing. The Digital Credit Providers Regulations of 18 March 2022 brought digital lenders under CBK licensing; made sharing of both positive and negative credit information mandatory (keeping the KSh 1,000 floor); required at least 30 days' notice before a negative listing and notification within 30 days after it; capped recovery on a non-performing loan at principal plus interest not exceeding that principal plus reasonable expenses; required an ability-to-repay assessment; mandated a complaints mechanism with 30-day resolution; prohibited phone-book access, shaming, and unsolicited messages to a customer's contacts in collection; and made any new product, product-feature variation, or change to the pricing model or its parameters subject to the Bank's prior written approval — the lender's pricing parameters became a governed surface. The Office of the Data Protection Commissioner's December 2023 sector guidance documents what the app-lender class's collection side had been doing — a worked example of an app that on installation takes "phone contacts, call logs, pictures, location, messages, all mobile phone applications and everything in the phone" and stores it "as a collateral," and providers sharing customer data with marketing companies without consent — and directs providers to collect transaction detail only. Licensing proceeded at scale: 227 licensed digital credit providers by 14 April 2026, from more than 800 applications since March 2022, with licensed providers having granted 7.5 million loans worth KSh 133.5 billion as of February 2026; the CBK states the regime was precipitated by "the predatory practices of the unregulated DCPs, and in particular, their high cost, unethical debt collection practices, and the abuse of personal information." The regime is now broadening rather than settled: the Business Laws (Amendment) Act 2024 recategorised digital credit as non-deposit-taking credit business, and draft successor regulations exposed for comment in August 2025 would rename the category — a draft, not a replacement, as of this writing.
The sociotechnical reading
The governable surface in this deployment is a data frame, not a score. Every other lending case in this atlas begins with a credit file the applicant already has and asks how a model reads it; here the applicant has no file, and the system reads the record a phone company keeps of a person's life instead. That substitution changes what the deployment can be wrong about. A model reading a credit file can misjudge someone it looked at; a model reading a telecom trace can only look at people who leave one, so the population it excludes is invisible by construction — no six-month trace, no score, no decline record, no log entry anywhere for anyone to review. And the frame has no single owner: the bank governs the decision but the operator owns the store, so the coverage question — who never gets scored at all — belongs to nobody. No source in this record measures that coverage gap, and this case file deliberately implies no figure for it. The second structural fact is where the adverse output lands. This deployment's failure mode is not a wrong decision in its own file; it is a write into a shared register every other lender reads, so an arrears spiral that began, in the evaluated era, with a hundred-shilling loan could end as a market-wide exclusion outliving the lender's relationship with the person. The listing rate is partly a lender-reporting behaviour — 38.4% of digital defaults reported against 22.7% of formal ones — which is why the register is the load-bearing store in the Lab diagram, and why the strongest checks in the real record are checks on the write: a numeric floor, notice duties, a bar on furnishing information believed inaccurate, and a one-off mass delisting that had to be imposed because nothing in the ordinary course removed entries.
What the governance record shows is regulation of the rule, never of the decision. There is no per-application human anywhere to instruct, so every instrument that landed acts upstream or downstream of the automated pipeline: the 2020 floor bounds the exclusion write, the 2022 regime licenses the lender and gates the pricing model and its parameters behind prior written approval, and the 2023 guidance bounds what may be collected into the frame. That shape is the finding, stated as the record states it: the levers this record supports are the state's instruments — gates on the write, reconciliation on the register, a resourced redress desk, minimization on the frame — and the one pathway none of them reaches is the product team's own hand on the scoring rules, which in the real arc only the regulator's approval gate touches, from outside. The two-sided record travels with all of this: the same deployment carries the family's cleanest measured service benefit (6.3 percentage points of shock resilience, 34% take-up, no substitution for other credit) and the family's sharpest published bound on what its score separates at the margin (0.007 against 0.066, a design check local to the cutoff, not a global accuracy figure). The honest boundary holds as always: borrowers are served people outside the dynamics, the market's default and listing rates are recorded observations about cohorts the sources themselves describe as differently situated — the digital cohort is lower-income and more vulnerable than the formal one, so no causal reading is licensed — and nothing on the diagram computes a repayment, a listing, or a household outcome.
The concepts used in this reading are defined in the Field Guide; the governance responses live in the Practice Library.