What happened

The Central Bank of Kenya (CBK) published a draft Guidance Note on the use of artificial intelligence (AI) in the banking sector on 15 May 2024. The draft was prepared in collaboration with Deloitte, which provided technical input on AI risk management and industry best practices. CBK invited banks, fintech firms and other stakeholders to submit written comments within a 60‑day window, ending on 14 July 2024. The guidance aims to formalise how AI tools are developed, tested and monitored across Kenyan financial institutions.

Context and background

AI technologies such as machine learning, natural language processing and predictive analytics have been adopted by Kenyan banks over the past five years to improve credit scoring, fraud detection and customer service. The rapid uptake was largely driven by competition from mobile‑money platforms and the desire to reduce operational costs. However, the lack of a clear regulatory framework raised concerns about algorithmic bias, data privacy and systemic risk, prompting the CBK to act.

Deloitte’s involvement reflects a broader trend of international consulting firms assisting regulators in shaping AI policy. In its advisory role, Deloitte benchmarked Kenya’s emerging AI practices against standards set by the Basel Committee on Banking Supervision and the Financial Stability Board. The firm also helped draft sections on model validation, governance structures and the need for explainable AI, ensuring the guidance aligns with global expectations while remaining practical for local banks.

Previously, CBK issued a 2022 circular on digital banking that focused on cybersecurity and cloud adoption, but it did not address the specific nuances of AI‑driven decision‑making. The new draft therefore fills a regulatory gap by requiring banks to document data sources, monitor model performance and maintain audit trails for AI‑generated outcomes. It also references Kenya’s Data Protection Act of 2019, reinforcing that personal data used in AI models must be processed lawfully and with explicit consent.

Stakeholder reaction has been mixed. Large commercial banks welcomed the guidance as a step toward greater transparency, while smaller credit‑unions expressed concern about the resource burden of compliance. Consumer advocacy groups, meanwhile, urged CBK to include stronger safeguards against discriminatory outcomes, especially in loan underwriting where AI could unintentionally reinforce existing socioeconomic biases.

Compared with what is normal

Prior to this draft, Kenyan banks operated under a relatively informal approach to AI governance, relying on internal policies that varied widely in depth and rigor. In contrast, the new guidance sets a baseline that mirrors practices in more mature markets such as the United Kingdom and Singapore, where regulators require documented model risk frameworks and periodic independent reviews.

• In Kenya, AI‑related compliance was previously optional; the draft makes it a mandatory component of the overall risk management framework.
• Typical model‑validation cycles in Kenyan banks have ranged from ad‑hoc checks to annual reviews; the guidance recommends quarterly performance monitoring and real‑time alerts for anomalous outputs.
• Data‑privacy expectations now align with the Data Protection Act, whereas earlier banks often relied on generic confidentiality clauses without explicit AI provisions.

Why it matters

For SME owners and finance teams, the guidance directly influences loan approval timelines. AI models that assess credit risk will need to be transparent, meaning banks must be able to explain why a particular application was rejected or approved. This could reduce instances of opaque decisions and give borrowers clearer grounds for appeal.

From a risk‑management perspective, the draft forces banks to embed controls that detect model drift – a situation where an AI system’s predictions become less accurate over time due to changes in data patterns. Without such controls, banks risk making poor credit decisions that could increase non‑performing loan ratios, ultimately affecting the cost of capital for businesses.

Compliance costs are another practical consideration. Implementing the required governance structures may entail hiring data‑science specialists, investing in model‑monitoring software and conducting staff training. While larger banks may absorb these costs, smaller institutions could face tighter margins, potentially leading to consolidation in the sector.

Finally, the guidance signals Kenya’s ambition to be a regional hub for responsible fintech innovation. By establishing clear rules now, CBK hopes to attract foreign investment in AI‑enabled financial services while protecting consumers and the stability of the banking system.

Practical steps

• Review the draft Guidance Note in detail and map its requirements against your bank’s existing AI policies.
• Conduct a gap analysis to identify missing documentation, model‑validation procedures or data‑privacy safeguards.
• Engage a qualified data‑science or risk‑management consultant to design a compliant AI governance framework before the 14 July comment deadline.
• Start a dialogue with your technology vendors to ensure their AI solutions can generate the audit trails and explainability reports demanded by CBK.
• Set up an internal task force that includes compliance, IT and business units to monitor ongoing regulatory updates and prepare for the final version of the guidance.

Our Financial Management & Analysis service can help your organisation interpret the draft, assess compliance gaps and design cost‑effective controls that align with CBK’s expectations.

Need help with compliance? Email info@beavorenventures.co.ke or call +254 716 296 857.

Disclaimer: This article is informational and does not constitute formal tax, audit or legal advice. For guidance specific to your circumstances, please contact Beavoren Ventures.